Audit de télémétrie de l’IA locale

Réponse rapide

« Local » n'est pas la même chose que « hors ligne ». Des quatorze outils d'IA auto-hébergés audités ici, seuls quatre sont vraiment à zéro sortie par défaut (llamafile, whisper.cpp, KoboldCpp, llama.cpp avec un fichier de modèle local). Trois livrent la télémétrie d'usage ACTIVÉE — vLLM (stats.vllm.ai, toutes les 10 minutes), AnythingLLM (PostHog) et Open WebUI (PostHog via son ChromaDB intégré, bien que l'image Docker officielle la pré-désactive) — toutes honnêtement documentées et toutes désactivables avec une variable d'environnement. Ollama n'a aucune analytique, mais son application de barre des tâches vérifie les mises à jour sur ollama.com toutes les heures (le serveur sans interface est silencieux). LM Studio est à code fermé : sa documentation promet que vos conversations restent locales, mais cette promesse ne peut pas être vérifiée par le code, et il téléphone bien pour les mises à jour et les stats d'usage avec option de retrait. Les analytiques de GPT4All sont sur opt-in, pourtant son lanceur récupère inconditionnellement son catalogue en HTTP simple avec la vérification de certificat désactivée.

La règle du pleb : supposez que chaque interface graphique téléphone chez elle jusqu'à ce que le code source dise le contraire. Réglez DO_NOT_TRACK=1 globalement (vLLM, Open WebUI et d'autres le respectent), utilisez les variables d'environnement par outil ci-dessous, et pour un vrai air-gap : pré-téléchargez les modèles, puis mettez au pare-feu les domaines listés — une promesse de documentation n'est pas un socket observé silencieux.

none zéro sortie par défaut model-downloads-only récupérations initiées par l'utilisateur seulement update-check ping les versions telemetry / multiple analytiques ou plusieurs défauts ACTIVÉS A/B/C grade de preuve (code source / docs / communauté)

Outil	Sortie par défaut	Points de terminaison et interrupteurs	Télémétrie	Recette air-gap	Licence	Grade
llamafile~v0.10.x, July 2026	none	— aucun point de terminaison non sollicité	non/a	Run ./model.llamafile — weights are embedded in the executable, the HTTP server binds localhost only, zero outbound out of the box. Nothing to download, nothing to block.	Apache-2.0	A
The strictest air-gap answer on this list: a single Cosmopolitan-libc binary with the model inside. Preuve : official docs + source (Mozilla llamafile repo).
Whisper.cppmaster, July 2026	none	`huggingface.co` — GGML model download via the OPTIONAL download-ggml-model.sh helper (only when the user runs the script) Coupure : supply a local model path	non/a	whisper-cli -m /path/ggml-*.bin -f audio.wav makes zero network calls. The only outbound path is the user-run download helper script.	MIT	A
Plain C/C++ with no update check and no analytics. Preuve : source code (no HTTP client in core).
KoboldCpp~v1.9x, July 2026	none	`.trycloudflare.com` — optional public tunnel to your local server (also downloads the cloudflared binary on first use) (ONLY with --remotetunnel)* Coupure : do not pass --remotetunnel (default off)	noopt-in (all remote features)	koboldcpp --model model.gguf binds localhost:5001 with zero outbound. Skip --remotetunnel, AI-Horde worker mode and URL model fetch and it never opens a socket outward.	AGPL-3.0	A
Single-file binary; every outbound path is an explicit opt-in flag. Preuve : source code + maintainer README.
llama.cpp (llama-server)master, July 2026	none	`huggingface.co` — model download/revalidation for -hf / --hf-repo models (only when an -hf model is used (may revalidate cache at startup)) Coupure : use a local -m path.gguf, or pass --offline	non/a	llama-server -m /path/model.gguf is fully offline — no update check, no analytics code in the binary. If you used -hf, add --offline to pin the cache.	MIT	A
The one caveat: an -hf-sourced model may GET huggingface.co at startup unless --offline is set. Preuve : source code (network only in the HF download path).
text-generation-webui (oobabooga)main, July 2026	model-downloads-only	`huggingface.co` — model/tokenizer downloads via HF Hub (user-initiated or uncached HF repo id) Coupure : HF_HUB_OFFLINE=1 + TRANSFORMERS_OFFLINE=1, load local folders	noopt-out (project already disabled it for you)	Gradio's api.gradio.app analytics is double-disabled in-tree (GRADIO_ANALYTICS_ENABLED=False + analytics_enabled=False). Export HF_HUB_OFFLINE=1 and TRANSFORMERS_OFFLINE=1 after caching models and it is fully offline.	AGPL-3.0	A
The historically risky path — Gradio's default telemetry — is explicitly neutralized in source. Preuve : source code (server.py, issue #801).
LocalAIv4.7.x, July 2026	model-downloads-only	`raw.githubusercontent.com` — default model + backend gallery indexes (when the gallery is used/auto-loaded) Coupure : --galleries='[]' --autoload-galleries=false --disable-gallery-endpoint `huggingface.co` — model weight downloads (user-initiated install) Coupure : preload local models `quay.io` — OCI backend images (v3+ runtime backend pulls) (backend install) Coupure : pre-provision backend images	non/a	Preload models ($LOCALAI_PRELOAD_MODELS) and backends, then --autoload-galleries=false --galleries='[]' --disable-gallery-endpoint. The local /metrics endpoint is Prometheus-style with no egress (disable: $LOCALAI_DISABLE_METRICS_ENDPOINT=true).	MIT	A
The one telemetry scare was a misread of the bundled OpenTelemetry /metrics endpoint — local-only; the maintainer rebutted it and shipped a disable flag. Preuve : maintainer statement (issue #3942) + source + CLI docs.
OllamaJuly 2026 (updater unchanged for years)	update-check	`ollama.com` — desktop tray-app update check (GET /api/update) (macOS/Windows GUI only, ~hourly) Coupure : run headless ollama serve (Linux/CLI has no updater), or firewall the domain `registry.ollama.ai` — model layer/manifest pulls (only on ollama pull/run of a non-local model) Coupure : n/a — user-initiated; fully local once cached	non/a	ollama serve has no updater and no analytics SDK — pre-pull your models and it runs fully offline. The only unsolicited ping is the GUI tray updater: use the server binary or block ollama.com.	MIT	A
"Zero telemetry" is true of analytics but imprecise for the desktop app — the tray updater phones ollama.com hourly. Server use: genuinely silent. Preuve : source code (app/lifecycle updater.go; no analytics SDK in repo).
ComfyUI (core)master, July 2026; Manager + Desktop are separate products	none	`api.comfy.org` — ComfyUI-MANAGER node-registry fetch (not core) (Manager startup unless offline mode) Coupure : network_mode = private or offline in Manager config.ini `raw.githubusercontent.com` — Manager node-DB channel lists (Manager catalog refresh) Coupure : Manager offline mode `github.com` — core frontend package resolution; Manager node clones (frontend version resolution / user installs) Coupure : pin --front-end-version; install offline	no (core even sets DO_NOT_TRACK=1 and HF_HUB_DISABLE_TELEMETRY=1 itself)n/a (Desktop app's analytics are opt-in — a separate product using PostHog/Datadog per its privacy policy)	Core Python install is fully offline once models and frontend are present. If Manager is installed set network_mode=offline (and verify — reports exist it is not always fully honored). Avoid the Desktop build for true air-gap. Audit custom nodes separately — they run arbitrary Python.	GPL-3.0-only	A
Network activity blamed on ComfyUI is almost always the Manager extension or the Desktop app, not core. Preuve : source code (main.py) + Manager source + comfy.org privacy docs.
Jan~v0.8.x (Tauri), July 2026	update-check	`apps.jan.ai` — Tauri auto-updater (on launch / update check) Coupure : disable auto-update or firewall `github.com` — fallback updater manifest + update binaries (update check) Coupure : disable auto-update `eu-assets.i.posthog.com` — PostHog EU analytics (in app CSP) (ONLY if analytics toggled on) Coupure : leave Settings > Privacy > Analytics OFF (default off)	yes — PostHog EU, but OPT-IN and off by defaultopt-in	Analytics needs no action (default off). Disable the auto-updater or firewall apps.jan.ai + github.com; import local GGUF files and inference is fully offline.	Apache-2.0	A
Default install phones home only for update checks; exact PostHog ingest hostname unverified (CSP lists the EU asset host). Preuve : source code (tauri.conf.json updater + CSP hosts) + privacy docs.
GPT4Allv3.10.0 (Feb 2025 — app dormant since)	multiple	`gpt4all.io` — model catalog, release check, news banner — plain HTTP with certificate verification DISABLED (on launch, UNCONDITIONALLY (no toggle)) Coupure : none in-app — firewall the domain `api.mixpanel.com` — Mixpanel analytics (ONLY if opted in at first launch) Coupure : decline the opt-in prompt (default off) `api.gpt4all.io` — opt-in Datalake chat contribution (ONLY if Datalake enabled) Coupure : leave Datalake off (default) `api.ipify.org` — public-IP lookup within the opted-in analytics flow (only with analytics on) Coupure : off with telemetry	yes — Mixpanel, but OPT-IN and off by defaultopt-in (analytics + Datalake); the catalog/update/news fetch has NO toggle	Decline both first-launch prompts, then firewall gpt4all.io, api.gpt4all.io, api.mixpanel.com, api.ipify.org. Inference is fully local after model download; the unconditional catalog/news fetches fail harmlessly offline.	MIT	A
Genuinely opt-in analytics, but NOT zero-outbound: the launch-time catalog/update/news fetch runs plain HTTP with cert verification off and cannot be disabled in-app. Desktop app appears dormant since Feb 2025. Preuve : source code (network.cpp, mysettings.cpp, download.cpp).
LM Studio0.3.x line, July 2026 (closed source)	multiple	`unverified (update/CDN host not published)` — update check — sends app/OS version + IP per privacy policy (launch / periodic) Coupure : no dedicated toggle; block at network level `unverified (model catalog/hub)` — model search/downloads + anonymized search/download stats (when searching/downloading) Coupure : Settings: disable anonymous usage reporting	yes — anonymized usage/search stats per privacy policy (vendor undisclosed; closed source)opt-out	Disable anonymous usage data in Settings, pre-download models, then network-block the app. Docs state chats/RAG never leave the device — but closed source means none of it is code-verifiable.	Proprietary	B
Never describe LM Studio as zero-telemetry: it phones home for updates and ships opt-out usage stats, and exact domains are unpublished. Preuve : official docs only (lmstudio.ai/app-privacy) — no source to audit.
Open WebUIv0.6.x, July 2026	telemetry	`.posthog.com (via bundled ChromaDB)` — ChromaDB's anonymized product telemetry — a dependency, not an Open WebUI pixel (on vector-DB init/use)* Coupure : ANONYMIZED_TELEMETRY=false (official Docker image ships this) or DO_NOT_TRACK=true `unverified Scarf gateway` — install/pull download analytics (image/package pull) Coupure : SCARF_NO_ANALYTICS=true `api.github.com` — version/update check (admin version check) Coupure : unverified toggle; block the domain	yes — PostHog via the ChromaDB dependency + Scarf install analyticsopt-out (official Docker image pre-disables the ChromaDB telemetry)	Set ANONYMIZED_TELEMETRY=false, DO_NOT_TRACK=true, SCARF_NO_ANALYTICS=true (the first is already false in the official image). Chat inference itself stays local once models are on your runtime.	BSD-3-Clause + branding clause (since v0.5.4 — not pure OSI)	A
The telemetry originates in the bundled ChromaDB vector store; a ChromaDB pin fix landed in v0.6.18. Scarf destination domain unverified. Preuve : maintainer statement (discussion #15624) + .env.example + docs.
AnythingLLM~v1.15, July 2026	telemetry	`app.posthog.com` — PostHog Cloud anonymous product analytics (events like sent_chat, document_uploaded — metadata only, no content per docs) (ON BY DEFAULT: app start + tracked events) Coupure : DISABLE_TELEMETRY="true" env var (exact string match in source) or the in-app Privacy toggle `huggingface.co` — one-time built-in model/embedder downloads (user-initiated) Coupure : skip once local	yes — PostHog Cloud, ON by defaultopt-out	Set DISABLE_TELEMETRY="true" exactly (source checks === "true") or use the Privacy toggle; pick local providers only (Ollama/LocalAI + built-in embedder + LanceDB). Belt-and-suspenders: firewall app.posthog.com — issues #5496/#4534 suggest the flag alone may not kill every connection.	MIT	A
Docs say anonymous event metadata only, never chats/documents — but it ships enabled, which most self-hosters do not expect. Preuve : source code (server/models/telemetry.js, docker/.env.example).
vLLMv0.7–v0.11 line, July 2026	telemetry	`stats.vllm.ai` — first-party anonymous usage stats (GPU count/type/memory, cloud provider, OS/arch, vLLM version, model architecture) (on first engine start, then every 10 minutes) Coupure : VLLM_NO_USAGE_STATS=1, or DO_NOT_TRACK=1, or touch ~/.config/vllm/do_not_track	yes — first-party (no third-party SDK; collected data is publicly released)opt-out	Export VLLM_NO_USAGE_STATS=1 (or DO_NOT_TRACK=1) before launch; add HF_HUB_OFFLINE=1 with pre-downloaded weights for full air-gap. A local copy of what would be sent sits in ~/.config/vllm/usage_stats.json — read it yourself.	Apache-2.0	A
The most-cited surprise in local-AI serving: production inference engine, telemetry ON by default — though transparently documented and honoring DO_NOT_TRACK. Preuve : source code (vllm/usage/usage_lib.py) + official usage-stats docs.

Données ouvertes (CC BY 4.0) : CSV · JSON · API : /wp-json/dc/v1/ai-telemetry?tool=vllm

Produits, réparations et guides connexes

Dernière révision: 27 juillet 2026.