How to Securely Erase Local LLM Data from Enterprise AI PCs

The New Local AI Data Footprint

Artificial intelligence is moving from centralized cloud platforms onto employee laptops, engineering workstations and other enterprise endpoints.

Windows AI APIs can process supported workloads locally using a device's NPU, while Microsoft Foundry Local can download models into an on-device cache and run inference without sending input or output to Microsoft's cloud. This can reduce external data transmission, but it also means the organization becomes responsible for model files, prompts, responses, document indexes, caches and other AI-related artefacts retained on the endpoint.

An NPU is primarily a processing component; it should not be described as the main persistent storage location for AI data. The artefacts of concern generally reside on the laptop's SSD or NVMe storage, in application folders, user profiles, model caches, document indexes, databases and synchronized locations.

This creates a new endpoint-security problem. An employee can download a multi-gigabyte model, attach confidential documents, create an internal knowledge collection, discuss sensitive projects in saved conversations, and then uninstall the visible application. Some or all of the associated data may remain elsewhere in the user profile or in a custom model directory.

Why this matters during the device lifecycle

The local AI footprint should be reviewed when a device is:

• reassigned to another employee;
• returned after offboarding;
• sent to a third-party repair provider;
• returned to a leasing company;
• transferred to another department;
• sold through an ITAD provider;
• recycled or donated;
• involved in a privacy, legal or security investigation.

Why uninstalling is not enough

An uninstaller normally removes files that the installer manages. It may not know about custom model directories, downloaded models stored outside the application directory, saved conversations, manually imported models, document collections, embeddings and vector indexes, developer projects, container volumes, browser front-end storage, temporary exports, files synchronized to another device, or data already deleted through the operating system and left in unallocated space.

Ollama explicitly warns that downloaded models in a changed OLLAMA_MODELS location are not removed by its Windows installer. Jan separately documents a user data folder containing models, threads, settings and logs. These examples demonstrate why "application uninstalled" and "data sanitized" must be treated as different lifecycle states.

Selective Erasure vs Full-Drive Sanitization

The correct technique depends on whether the device will remain under organizational control and whether the local AI footprint can be completely identified.

• Remove one unauthorized model: Selective file and folder erasure. The operating system and unrelated business data must remain.
• Remove LM Studio conversations before internal reassignment: Selective erasure plus verification. Conversation JSON files can be scoped, but attached documents and copies must also be checked.
• Reassign an endpoint internally: Selective erasure plus appropriate free-space handling and verification. The OS may need to remain, but prior user data must not transfer.
• Return a leased AI PC or ITAD transfer: Validated full-drive sanitization. Administrators cannot safely assume every local AI location was found.
• Local AI footprint is unknown: Full-drive sanitization. Selective erasure cannot provide assurance over unidentified data.