Trust Center: AI models

Qwen: the local default model.

Self-hosted on Canvas servers at Hetzner in Germany. Your data never leaves the Canvas infrastructure at any point: there is no external AI provider in the data path.

Request documents Back to Trust Center

Runs entirely on Canvas infrastructure in Germany No data flow to any model provider Open weights, Apache 2.0 license

At a glance

The facts about Qwen on Canvas

Question	Answer
Model version	Qwen3-Coder-Next (FP8), a code model of the Qwen3 family: 80B parameters, 3B active, 262,144-token native context
Developer	Qwen team, Alibaba Cloud. Open weights; at inference time there is no connection to the developer whatsoever (see below)
License	Apache 2.0: commercial use, modification and self-hosting expressly permitted
Operation	Self-hosted on Canvas infrastructure (Hetzner Online GmbH, Germany)
Data residency	Germany, exclusively
Training on your data	No. The weights are static; there is neither training nor any transfer to a provider
Retention by a provider	Not applicable, there is no provider in the data path
Human review by a provider	Not applicable
Encryption	TLS in transit, AES-256 at rest, encrypted WireGuard network overlay (full measures: DPA, Annex AVV-2)
Contractual relationship	None needed with the model developer; the DPA with Canvas is the only agreement that matters

Where your data goes

Nowhere. That is the point.

Prompts and outputs are processed exclusively on Canvas servers in GermanyDE

Data flow to Alibaba, any other model provider, or any third partynone

External API in the data pathnone

Model weights are static numerical tensors in the safetensors format, with no networking capability of their own. Inference runs entirely inside the Canvas environment and works without internet access. The fact that the weights were developed by Alibaba Cloud is irrelevant for data protection: at inference time there is neither a technical nor a contractual relationship with the developer, and no data flows.

For co-determination and works councils, the local model is also the simplest answer: employee prompts never leave the company in the direction of an AI provider.

Versions & model lifecycle

Pinned, verified, never silently swapped

Currently in use: Qwen3-Coder-Next in FP8 quantization, obtained from the official Qwen repository.
Exactly pinned. Weights are referenced by checksum (SHA-256); a model change is a deliberate, traceable decision, never a silent swap in the background.
No provider deprecation. Because Canvas operates the model itself, no provider can switch a version off and force a migration.

On the EU AI Act: Qwen is a freely available open-weight model; the provider obligations for the model rest with its developer. When using it, Canvas and you act as deployers, with correspondingly well-defined duties.

Your control in Canvas

The default for every new repository

Preselected. Qwen is the default model of every new repository; your builders can see and change the per-repository selection at any time.
Visible residency. Every model carries its residency label (Local DE, EU, Third country); for repositories handling personal data, Canvas recommends Local or EU.
Recorded. Model assignments, requests and approvals are fully written to the audit trail.

How model selection works in the product: Documentation, AI models.

Sources & documents

Verify it yourself

Official model card on Hugging Face (Qwen organization), including license and architecture.
Apache 2.0 license in full.
Data processing agreement (DPA) with the technical and organizational measures (Annex AVV-2).

Questions about privacy and security: support@canvas.software. Responsible entity: Canvas AILabs GmbH, Knorrpromenade 8, 10245 Berlin, HRB 289368 (Amtsgericht Charlottenburg).