Protected does not mean private within the instance: everyone with access to the local registry can read it, and the organisation running the instance can remove it — unlike on the public network, where nothing is ever removed. Whether new nanopublications are protected by default is a setting of the instance.

The public network and the local instance are separate worlds. A protected nanopublication can refer to public ones, but a public nanopublication that refers to a protected one carries a link nobody outside can follow, which is why a form with a protected source keeps the result protected too.