Do not expose credentials to models
Secrets and production credentials should stay behind permissioned tools and deployment systems.
Know where the
work happens.
Local-first should be visible, not implied. Lwati is designed to separate browser-local work from connected services so users can understand which boundary a task crosses.
Local projectBrowser/device unless the user chooses account or connected workflows
Local AIModel inference on compatible user hardware
Science runtimesPython, SQL and R execute in browser sandboxes
Evidence searchUses external scholarly metadata services and requires connectivity
Account projectUses the Laravel application and its configured storage
Remote providerOnly applicable when a connected/Server AI provider is selected
DESIGN RULES
Minimise unnecessary data movement.
Separate local and remote states
The interface should tell the user when work is local, synced or dependent on a remote provider.
Make destructive actions reversible
Changes should be diffable, checkpointed or otherwise recoverable where practical.
Preserve provenance
Scientific results should retain dataset, runtime and analysis metadata rather than becoming unattributed text.
This page describes Lwati's product architecture and design intent. It is not a claim of third-party security certification. For account-specific or infrastructure questions, contact the Lwati team.