An open-weight model is a model whose trained files you can download and run on your own machines. That is different from using the vendor's website or app. For client confidentiality, the question is not "which model", it is "where does the client data go when you use it".
Last reviewed: 17 October 2026. Facts checked. We opened the Qwen3-8B page on Hugging Face (the developer's own model page), the DeepSeek-V3 page and its model licence file on Hugging Face, and OWASP's LLM02 page on sensitive information disclosure. We also ran a web search on hosted versus self-hosted use. We did not read either vendor's privacy policy. This post does not rank models and gives no benchmark scores.
A disclosure. CORAA runs open-source models on India-based infrastructure. We have a view on this topic, so we stick to what the primary pages say.
Open weights, in plain words
A model is a very large set of numbers, called weights. "Open-weight" means the developer published those numbers. You can run them without sending anything to the developer.
"Open-source" is a stricter word. It usually means the licence also allows free use, change and sharing. Many open-weight models carry their own licence terms, so read each one.
Two ways to use the same name
| How you use it | Where client data goes | Main confidentiality question |
|---|---|---|
| Vendor's website or app | The vendor's servers | What does the vendor's policy say about storage, location and training? |
| Vendor's API | The vendor's servers | Same, plus contract terms |
| Downloaded weights on your own server | Your server only | Who can access your server and its logs? |
| Downloaded weights on a hosting partner | The partner's servers | What does the hosting contract say? |
The model name is the same in every row. The risk is not. A search we ran on this topic found one consistent view: self-hosting removes most of the data-location concern, while hosted apps raise it. Most of those sources were vendor blogs, so treat that as a view, not a finding.
What the licences say
We read two developer pages.
- Qwen3-8B. The page lists the licence as Apache-2.0. The page gives 8.2B parameters.
- DeepSeek-V3. The page says the code repository is under the MIT License. It says use of the model weights is subject to a separate Model License, and that the series supports commercial use.
We also opened the DeepSeek model licence text (Version 1.0, dated 23 October 2023). It allows hosting for third parties, and it passes down use-based restrictions. One of them covers fully automated decision-making that adversely affects an individual's legal rights. Read the full text with your lawyer. We are not giving legal advice.
Licences differ by model and by version. Check the exact model you plan to use.
What self-hosting does not fix
Running the weights yourself solves where data goes. It does not solve everything.
- Wrong answers. Every model can state wrong things with confidence. See our guide on AI hallucinations in audit.
- Leaks through your own setup. OWASP lists sensitive information disclosure as a risk for LLM applications. Its page says restrictions in a system prompt may not always be honoured and could be bypassed through prompt injection.
- Access control. If every staff member can see every client's uploaded files through the tool, you have a confidentiality gap.
- Shadow use. Blocking one website does not stop staff using a personal account somewhere else.
DPDP and your client
India's DPDP Rules were notified on 14 November 2025, with an eighteen-month phase-in (PIB). A search of PIB releases confirmed the eighteen-month timeline. Some PIB pages give 13 November as the date, so check the Gazette text for exact dates.
If client files contain personal data, such as payroll or customer records, decide before upload where the data will be processed. Our DPDP compliance checklist helps you record that decision.
What this means for audit evidence
Confidentiality is one concern. Evidence is another. An AI answer is not audit evidence on its own. The working paper must show the source document, what was asked, which model and version produced the answer, and who reviewed it.
A short checklist before you use any open-weight model
- Write down which model, which version and which licence.
- Decide where it runs and who can access that server.
- Test it on anonymised files first.
- Keep prompts and outputs in the engagement file.
- Name a reviewer for every output that reaches a working paper.
Use the AI audit tool evaluation checklist to record the answers.
Frequently Asked Questions
Is DeepSeek safe for audit data?
It depends on how you use it. The hosted app sends data to the vendor's servers, so read the vendor's policy first. Downloaded weights run on your own infrastructure, which changes the data-location question. Neither option removes the need to check outputs.
Is Qwen open source?
The Qwen3-8B page on Hugging Face lists the Apache-2.0 licence. Other Qwen models may carry other terms, so check each model's own page.
Does self-hosting make a model accurate?
No. Self-hosting controls where data goes. Accuracy depends on the model, the prompt and the checks you add.
Do we need client consent to use AI on their files?
That depends on your engagement terms, confidentiality duties and the data involved. Raise it in the engagement letter and take professional advice where unsure.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error