A knowledge base is only half a brain. The other half is the model — and the moment you have more than one document class, “which model” stops being a preference and becomes a routing decision. I answer it with two engines: a cloud one for what is not sensitive, and a local one for what is. This post is about the cloud half and the single rule that keeps it honest.
This is Part 3 of 6 in the Building a Private Local-AI Stack series.
- The Use Case
- LightRAG as a Personal Knowledge Base
- OpenRouter and the Case for Safe Models (this post)
- Right-Sizing a Local LLM with llmfit
- AionUi: A GUI for Your CLI AI Agents
- Basic Memory: An AI Memory in My Obsidian Vault
One API, One Key, No SDK Churn
OpenRouter’s model routing abstraction — one API fronting many providers, with optional pinning for predictable request paths. Source: skywork.ai
The model landscape moves too fast to marry a single provider. Last quarter’s obvious choice is mid-tier now, the good one is behind a different API, and I didn’t want agents littered with provider SDKs — each a separate thing to break.
OpenRouter solves that. One endpoint, one key, one request format. Behind it, a catalogue of models from every provider that matters. I change which model an agent uses by changing a string. No new SDK, no auth dance, no code rewrite. For a stack meant to outlive any given model generation, that indirection is valuable on its own.
But the feature that made me adopt it is not the breadth. It is the control.
Pinning: Predictability Over Convenience
By default, an aggregator routes you to whoever is cheapest or fastest. Two providers serve the same model? It picks one. That one goes down? It falls back. For a chat toy, fine. For unattended automation, a liability.
I haven’t vetted every provider in the catalogue — I vetted some. Read their terms, checked retention, decided I’m comfortable sending them non-sensitive work. If the router falls back to a provider I never looked at, my vetting is theatre. My request lands somewhere I didn’t choose, under terms I didn’t read, and I find out never — or when a bill arrives from a provider I didn’t know I was using.
OpenRouter lets me shut that door. I pin a specific provider and disable fallbacks. One of two things happens: my request goes to the provider I vetted, or it fails. It never quietly reroutes. A hard failure I can see and handle; a silent switch to an unvetted provider is the thing I fear, and pinning makes it impossible.
Concretely: I pin to Amazon Bedrock for a model several providers offer, and tell OpenRouter that if Bedrock can’t serve it, don’t go elsewhere. I get the model under terms and jurisdiction I chose, or a clean error.
Predictability matters because unattended automation that behaves differently depending on which provider won the routing lottery is an agent I can’t reason about. Pinning fixed it. Model fixed, provider fixed, behaviour repeatable.
What Makes a Model “Safe”
This is the part that earns OpenRouter its place: I deliberately route non-sensitive documents to vetted cloud models. Not grudgingly — as the primary path. Most of what my agents touch isn’t sensitive. Public notes, reference material, draft prose, code I’d paste into a gist. For all that, a good cloud model is faster, more capable, cheap enough that running local is waste. There’s no privacy argument against sending content that’s already public.
So the question isn’t “cloud or local.” It’s “is this model safe for this data class.”
A model isn’t safe in the abstract. It’s safe for a given sensitivity class or it isn’t. I judge on three things, and I read the fine print before I pin a provider.
Provider terms. What does the contract permit them to do with my input? I read the terms of the specific provider I’m pinning — not the marketing page, the actual ToS. The pinning discipline makes this meaningful. Vetting terms is pointless if the router can reroute past them.
Data retention and training policy. Do they retain prompts? For how long? Do they train on inputs by default, and can I turn that off?
Jurisdiction. Where does the request land physically, whose law governs it? For non-PII work this is a soft factor, but still a factor.
A model clears the bar when all three line up for the data class I’m sending. The same model can be safe for public notes and unsafe for anything personal. “Safe” is a relation between a model and a kind of data, never a property of the model alone.
The Line Personal Data Never Crosses
Here’s the rule: PII and sensitive documents never touch any cloud model. Full stop.
Not the vetted ones. Not the pinned ones. Not the provider with spotless retention. The safe-model machinery is a tool for the non-sensitive half, and it stops at the sensitivity boundary from Part 1. Anything personal, financial, or private doesn’t go to OpenRouter, no matter how good the terms. Vetting reduces risk; it doesn’t eliminate it. For data that would genuinely hurt to leak, “reduced risk” isn’t the standard. Zero exposure is.
The reason I hold this line is the failure mode is irreversible. A public note sent to a provider that trains on it is an annoyance. A sensitive document in someone else’s training corpus is a fact I can never take back. For non-PII work that’s a bet I’m happy to make. For the sensitive half it’s a bet with no upside worth the downside.
That’s why sensitive work stays on a local model, on my hardware, where the request never leaves the machine. OpenRouter handles the non-PII side well. The other side runs on iron I control, and no amount of vetting moves a private document across that line.
Which raises the question: if the sensitive half runs locally, which local model, on hardware that is not a datacentre? Picking one that fits real constraints is harder than it sounds, and I stopped guessing once I found the right tool.
What’s Next
The cloud engine is settled: OpenRouter, pinned providers, no fallbacks, safe models for non-sensitive work. The local engine is the other half of the boundary, and it has to earn its keep on hardware I own. Part 4 is right-sizing that local LLM with llmfit — how I stopped guessing which model fits and started measuring it.
Any opinions in this article are my own.