Own It

A Privacy Checklist Before You Go Live

Network exposure, access control, data handling, and physical security - a checklist to run before opening your setup up beyond yourself.

9 minute read

Why a checklist, not another guide

Every guide in this pillar covers one decision in depth. This page is different on purpose - it's the short version of all of them, in one place, meant to be run through in one sitting right before your setup stops being just-you-on-one-machine and starts being reachable by something else: another device on your network, a Discord bot, anyone else in your household.

Nothing here is new information. If you've read the other Own It guides, this is just the moment to actually confirm you did the things they suggested.

Network exposure

  • ☐ OLLAMA_HOST is not set to 0.0.0.0 unless you have a specific, ongoing reason for it (check with echo $OLLAMA_HOST)
  • ☐ If you followed Accessing Your Setup From Other Devices, you know that means anyone on your home network can reach it, not just you
  • ☐ Nothing is exposed to the internet - that's a meaningfully bigger step than anything covered on this site, and not something to do casually

Full detail: Locking Down Your Local AI Setup.

Access control

  • ☐ If you're running OpenClaw, an allowFrom list is set so only your own account can message the bot
  • ☐ If more than one person uses your Open WebUI instance, each person has their own account rather than sharing one login
  • ☐ Any credentials involved (Discord bot token, etc.) are stored in config, not pasted into a chat message or committed anywhere public

Data handling

  • ☐ You know where your chat history actually lives, and that it's separate from your installed models
  • ☐ You know what a full reset does and doesn't remove
  • ☐ A backup of your chat history, Modelfiles, and any RAG source documents exists somewhere other than the same drive they came from
  • ☐ That backup has actually been restored once, at least as a test - an untested backup is a hope, not a backup

Full detail: What Happens to Your Data and Backing Up Your Local AI Setup.

Physical security

  • ☐ Disk encryption is on - FileVault, BitLocker, or LUKS depending on your OS
  • ☐ OS security updates are set to install automatically, or you have an actual habit of checking for them (see Keeping Everything Updated)
That's the whole list. None of this is exotic - it's the same baseline you'd want for any always-on device on your network. The only thing specific to local AI is that this machine now holds something worth protecting: real conversations, and possibly real documents, that used to live somewhere else entirely.

Common questions

Do I need to do all of this before I even start using my setup?
No. This is specifically for the point where your setup becomes reachable by more than just you sitting at the machine - other devices on your network, a Discord bot, anyone else in your household. Using it alone, on one machine, the defaults are already reasonably safe.
Is this a one-time checklist or something I repeat?
Mostly one-time, revisited any time something changes - a new device gets access, you connect OpenClaw to a real channel, you move the machine to a different network. Treat it as a gate for changes, not a recurring chore.

Go deeper

This page is a summary. Here's the full detail behind each item.

Locking Down Your Local AI Setup The full reasoning behind network exposure and disk encryption. What Happens to Your Data Where everything actually lives, and what a reset really removes.

Written from hands-on security operations experience. More about this site →