What leaves the building from Substrate

The question usually comes from the security team, and it usually comes early. Before anyone discusses models or latency, someone asks what the platform sends out. For most AI software the honest answer is a list: usage telemetry, crash reports, model fetches, licensing checks, and sometimes the prompts themselves. For Substrate the honest answer is one word.

Nothing. The rest of this article is about why that answer holds for each kind of data the platform touches, because a one-word answer deserves to be checked.

The data the models touch

Every call to the API arrives over the facility network and is answered from the appliance. The prompt, the image, the audio clip, the robot's observation: these are processed by models running on the Czar and the result is returned to the caller. No request is forwarded to any external service, because the open-weight models Substrate serves have nothing external to consult and the appliance has no route on which to forward anything.

Perception workloads are the heaviest and the most sensitive. A pool serving a fulfillment floor sees the floor continuously. Those frames are inferred on and, where the site chooses, kept on the appliance for Adaptation. They are not sampled, summarized, or uploaded. The footage of the building stays in the building.

Retrieval grounds answers in the site's own documents and cites them. The documents are read from wherever the site keeps them, over a declared route on connected sites or loaded directly on isolated ones, and the index is built and stored on the appliance. Neither the documents nor the index leaves. Memory, the persistent semantic state that keeps agents coherent across sessions, is on the appliance too. It is not synchronized to any external store and there is no account anywhere that it is tied to.

The things the site builds

Adaptation fine-tunes open models on the site's data, entirely on the appliance. The adapters it produces are the customer's property and they stay on site unless the customer carries one elsewhere as a signed artifact under their own control. Element 31 does not receive adapters, does not aggregate them, and does not use one site's adaptation to inform another's.

Evaluation records every AI operation. Watchman writes integrity deviations to an append-only record. The provenance record for each node documents integration, sealing, and software load. All of these are written locally and read locally. They are the site's evidence, held by the site. Nothing in the record is reported upstream.

Telemetry, health, and billing

The platform never phones home. There is no heartbeat, no crash reporter, no update checker. Health and metrics are exposed on the facility network for the site's own monitoring tooling to read. If Element 31 wants to know how a site is doing, the only way to find out is for the customer to say.

The subscription for the configured appliance is one fixed line for the term. There is no usage meter to report because the price does not depend on usage. Billing lives on the portal, and the appliance never connects to the portal. Update bundles are downloaded by the customer, not fetched by the appliance, so even the update process produces no outbound traffic from the rack.

Why the answer holds on connected sites

A connected site declares Local Bridge routes to systems it already secures: a warehouse system, a document store, a message bus on the plant segment. Each of these is inside the same perimeter as the appliance. Data moving over a declared route moves from one of the site's systems to another of the site's systems. It does not cross the building's boundary, and there is no route that could carry it across. Connected does not mean connected outward.

The one exception people raise is the support session. A session is customer-initiated, and on a sovereign site it requires the customer's attestation that data disks are detached, the network is isolated, the console is supervised, and the person opening it has authority. It carries a hard expiry. The site decides when it opens, watches it while it is open, and sees it close. That is a supervised act by the customer, not a path the platform uses on its own.

How to verify it

A site does not have to take the word nothing on faith. The declared routes are listable. The absence of a default path is a property of the platform, described at /security. Watchman confirms the appliance is running the signed image it claims, so the platform whose behavior is being described is the platform actually installed. And the record shows every connection Local Bridge made or refused. Between those, a site can check the one-word answer against its own evidence, which is how the answer was meant to be checked.