Security & Architectural Specifications
FineTuneMyAI is engineered specifically for regulated industries, proprietary IP, and security-first engineering teams.
Operational Boundaries: Local Training vs. Hosted Inference
Execution takes place entirely on your physical workstation (Apple Silicon, NVIDIA CUDA, or Windows). Model weights, training datasets, raw text, embeddings, and LoRA/QLoRA adapter checkpoints remain strictly on local storage. No training data is ever transmitted to the cloud.
When you explicitly choose to deploy a trained model for cloud serving, the exported adapter weights are securely transmitted via TLS 1.3 to FineTuneMyAI managed GPU clusters. Compute is billed per GPU second consumed with isolated container runtimes and OpenAI-compatible API authentication.
What Remains On-Device in Local Mode
Cryptographic Device Pairing Architecture
Device registration establishes a cryptographically authenticated channel between your browser control plane and your local daemon:
The web control plane generates a time-limited 6-digit pairing code linked to your authenticated user account. Codes expire automatically after 10 minutes and enforce strict rate limiting.
When paired, the local agent generates an asymmetric Ed25519 keypair entirely on-device. The private key never leaves the workstation and is stored in secure OS storage (macOS Keychain, Linux Secret Service, or Windows Credential Manager).
The server validates the device public key and issues a high-entropy 256-bit bearer token, storing only its SHA-256 hash. Signed device requests use Ed25519 verification together with timestamps and replay-resistant nonces; the bearer token is scoped to the paired device credential.
The FineTuneMyAI control plane does not expose arbitrary shell commands or remote execution interpreters. Communication is strictly restricted to typed, allowlisted ML lifecycle operations (TRAIN_START, TRAIN_STOP, EVALUATE_START, INDEX_START). Any command outside this validated manifest is rejected at the daemon boundary.