Model licenses, provenance and privacy

This is general information, not legal advice. Read the licence of the exact model you ship, and ask a lawyer about anything commercial or high-stakes.

Two questions decide whether a model is usable in a real product: may you use it for this purpose, and can you trust where it came from and where your data goes. Both are routinely skipped by teams that fall in love with a model's benchmark scores.

#Licences: "open weights" is not "open source"

"Open weights" means the parameters are downloadable. It says nothing about what you are allowed to do with them. Common licence families:

Licence type	Typical terms
Apache 2.0 / MIT	Very permissive: commercial use, modification and redistribution allowed, with notices (for example many Qwen, Phi and Mistral releases)
Llama Community Licence	Commercial use allowed with conditions: attribution and naming requirements, an acceptable-use policy, and a special licence required above a very large user count; read the version for your model
Gemma Terms of Use	Use allowed subject to Google's terms and prohibited-use policy; redistribution conditions
OpenRAIL-style licences	Allow use but attach behavioural restrictions that must be passed on
CC BY-NC and "research only"	No commercial or production use
Custom or proprietary "source-available"	Read every clause; thresholds and field-of-use limits are common

Licences can differ per size within a family (some sizes of a family use more permissive terms than others), and per version (a newer release may change terms). Check the model card and licence file of the exact checkpoint you use, and keep a record.

#What to look for

Question	Why it matters
Is commercial use allowed?	Some licences forbid it, or require a separate agreement above a threshold
Are there field-of-use restrictions (an acceptable-use policy)?	Certain applications (for example weapons, some medical or surveillance uses) may be prohibited
Can I fine-tune it, and do the terms follow the derivative?	Usually yes, and usually the obligations pass to your fine-tune
Can I redistribute the weights or a quantised version?	Often yes with notices; sometimes restricted
Are there naming or attribution rules?	Some require "Built with ..." or a model-name prefix
Does the licence limit using outputs to train other models?	Some do
Are there user-count thresholds?	A special licence may be needed at scale
What does the licence say about liability and warranties?	Usually "as is"

Also consider training-data concerns: a model trained on data of uncertain provenance can create copyright or privacy questions for regulated or high-visibility products (compliance).

#Datasets and tools have licences too

Fine-tuning datasets, embeddings models, rerankers, tokenizers and even prompt libraries carry their own terms. A permissive model fine-tuned on a non-commercial dataset may inherit the restriction.

#Keep a record

A short table in your repository avoids panic during a customer review:

Component	Version / hash	Licence	Source	Date checked	Notes
Base model	org/model-8b-instruct @ commit abc123	Licence X v1.1	Hugging Face	2026-11-01	Commercial OK, attribution required
Quantised file	Q4_K_M, sha256 ...	inherits base	quantiser's repo	2026-11-01
Embedding model	name @ commit	Apache 2.0	Hugging Face	2026-11-01

Save a copy of the licence text, since it can change.

#Provenance and supply chain

Where a model came from matters for both trust and legality.

Download from official or reputable accounts; check the model card and file hashes. Look out for look-alike repository names.
Prefer safetensors and GGUF. Pickle-based .bin and .pt files can run arbitrary code when loaded, and trust_remote_code=True executes the repository's Python.
Pin versions (commit hashes) for reproducibility, and store a checksum.
Prefer models with a clear model card: training data summary, intended use, known limitations and evaluation results.
For quantised and merged models, check who made them and from what base; anonymous merges deserve extra suspicion.

The full checklist is in supply chain and stack security.

#Is local really private?

Running locally can mean data never leaves your machine, but verify it. The model weights are private; the software around them may not be.

Leak path	Check
Telemetry	Some apps phone home with usage data. Read the settings, and watch network traffic
Update and model downloads	Auto-updates and "download model" features contact servers by design
Tool use	A tool that fetches URLs, searches the web or sends email breaks the boundary
Logs	Servers and chat apps may write prompts and replies to disk; set retention and location
Exposure	Binding to `0.0.0.0` without authentication exposes your model and data to the LAN
Disk	Chat histories and caches live on disk; use full-disk encryption
Plugins and extensions	Editor and browser extensions may send content elsewhere
Crash reports	May include prompt fragments
Cloud sync	Backup tools copy conversation files to the cloud

#How to test it

Offline test: disconnect the network (or block the app in a firewall) and confirm everything still works.
Traffic monitoring: use your OS's network monitor, a local firewall that lists outbound connections, or packet capture (tcpdump, Wireshark) and run a prompt with a unique marker string. Search the capture for the marker.
Offline flags: many libraries support offline modes, for example HF_HUB_OFFLINE=1 and TRANSFORMERS_OFFLINE=1 for Hugging Face tooling, which stop attempts to reach the hub.
Read the privacy policy and source of the tools you use. Open-source clients let you check what is sent.

#Air-gapped checklist

Download the models, runtime and dependencies first, and verify their checksums on a connected machine.
Transfer them to the isolated machine.
Disable auto-update and any telemetry.
Block outbound traffic at the firewall, and confirm with a packet capture.
Store logs on encrypted disk with a retention limit.
Document the setup so it is repeatable and auditable.

#What local does not fix

Output quality and safety. Models can still produce wrong, biased or harmful text.
Prompt injection. A local model that reads untrusted documents can still be manipulated (prompt injection).
Compliance obligations. Privacy laws apply to the personal data you process, whether or not it leaves the building (compliance).
Insider and device risk. A stolen laptop with unencrypted chat history is still a breach.

#Safety and compliance

For regulated domains (health, finance, legal, hiring), add human review, logging, evaluation and documentation before deployment (evaluation courses). Document which model, version and prompt produced each output so you can answer questions later (rollouts and versioning).

#A pre-adoption checklist

Licence read for the exact checkpoint; use case and scale permitted; record saved
Fine-tuning and redistribution plans checked against the terms
Source verified; safetensors or GGUF; commit and checksum pinned
Datasets and companion models checked for their own licences
Network behaviour tested (offline run or traffic capture)
Telemetry and auto-update disabled where required
Logs, caches and chat history locations known, encrypted and retention-limited
Server not exposed to the network without authentication and TLS
Human oversight and evaluation in place for sensitive uses

#Common mistakes

Assuming "open" means "free for anything".
Checking the family's licence instead of the exact size and version.
Forgetting that fine-tunes inherit the base model's obligations.
Trusting "runs locally" as a privacy guarantee without testing.
Using random re-uploads of popular models.
No record of what was checked and when.

#Exercise

Your company wants to ship a customer-facing app built on a community-licensed 8B model, fine-tuned on support tickets, running on customers' own servers.

List four licence and data questions to answer before launch.
How would you demonstrate to a privacy-conscious customer that the app does not send their data out?

Answers:

(a) Does the licence allow commercial use at your scale, and does it require attribution or naming? (b) Does it allow you to redistribute the weights to customers, and under what conditions? (c) Do the base licence's obligations pass to your fine-tune, and are there prohibited uses that conflict with your product? (d) Do the support tickets contain personal data you are allowed to train on, and does any dataset or companion model carry its own restrictions?
Provide a documented, repeatable test: run the app with outbound traffic blocked, show a packet capture with a marker prompt and no outbound connections, disable telemetry by default, document what logs exist and how long they are kept, and offer an offline-capable deployment guide.