From 659ace173a78391a5c484b55e2b1f633ea850fd9 Mon Sep 17 00:00:00 2001
From: jules <cloudtech@juleslive.net>
Date: Sat, 20 Jun 2026 21:58:44 +1000
Subject: [PATCH] feat(privacy): surface LLM data-egress destination to users
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Transparency indicator (frontend audit rank 11): a notice in the AI surface
telling users their prompts/data are sent to the configured provider, and that
non-local providers are third-party services. Does not change data flow — the
full fix (route egress through arcadia-llm-gateway with redaction) is gated on
that gateway being deployed. Uses universal theme tokens; finance builds clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/routes/assistant.tsx | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/app/routes/assistant.tsx b/app/routes/assistant.tsx
index 05c6510..09f3d2f 100644
--- a/app/routes/assistant.tsx
+++ b/app/routes/assistant.tsx
@@ -1059,6 +1059,16 @@ function AssistantSurface({
         </div>
       )}
 
+      <p
+        data-slot="llm-egress-notice"
+        className="rounded-md border border-border bg-muted/50 px-3 py-2 text-xs text-muted-foreground"
+      >
+        <strong className="text-foreground">Where your data goes:</strong> your
+        messages — plus any platform data the assistant pulls in (tenant, user,
+        and billing rows) — are sent to the operator-configured LLM provider.
+        Unless that's a local model, it's a third-party service.
+      </p>
+
       <div
         ref={scrollerRef}
         className="flex-1 overflow-y-auto rounded-lg border bg-card/30 p-4"
-- 
2.48.1