Security & data flow
What actually leaves your machine.
Companion is sold to people who are professionally obliged to check. So this page is written for the checking: every route out of your computer, what travels on it, who receives it, and the places where our answer is not the one we would like it to be.
The shape of it
The intelligence comes to the data.
The agent, your conversations and the memory graph are processes on your own hardware, reading and writing your own disk. Nothing is uploaded for the product to function.
Everything on the right leaves only because you asked for it — by choosing a model provider, connecting an account, or turning sync on. Each one is listed in full below, including what it can see.
Route by route
Every connection, named.
Six ways out, and what each one carries.
- 1 · The model call — to the provider you chose, on your keyYour prompt and the context the agent assembled go to the model provider you selected, billed to your own account. It does not pass through any server we operate, and we never see it. This is the one connection Companion cannot work without — the model runs remotely, and that means the question leaves your machine even though your data lives on it. Running the model on your own hardware is the next thing we are building, and it is what would make this genuinely air-gapped.
- 2 · Accounts you connect — only the ones you connectIf you connect a mailbox, a calendar or a drive, Companion talks to it on your behalf through an integration broker. Connect nothing and nothing is contacted. Please read the open finding at the bottom of this page before connecting a third-party account that holds regulated or client-confidential material.
- 3 · Memory indexing — this one surprises people, so we are putting it firstThe memory graph is stored on your disk, but the indexing is not local yet. To make memory semantically searchable, the text being remembered is sent to a hosted embedding service (Cloudflare Workers AI, model
bge-large-en-v1.5) and the vector comes back. Today that call uses a credential bundled with the app, shared across installs. You can point it at your own account withCLOUDFLARE_AUTH_TOKEN. A bundled local embedder is in progress and removes this route entirely; until it ships, “the memory graph is on your machine” is true of storage and not yet true of indexing. - 4 · Multi-device sync — off by default, and not end-to-end encryptedIf you enroll a second device, your event log replicates through a relay we run. It travels over TLS and it is stored on our infrastructure, but it is not end-to-end encrypted: conversation content is readable server-side. We are telling you this rather than letting you infer it from the word “encrypted”. If your threat model does not permit that, leave sync off — the local product is complete without it, and every other feature on this page still works.
- 5 · Sign-in — the data plane is local, the login is notAccounts are handled by Google Firebase, so an email address and authentication metadata sit with a cloud identity provider. You do have to sign in to open the app — that is the one thing the account is for, besides tying your machines together for sync and the Companion Network. Nothing you work on is held there.
- 6 · Crash reports — diagnostics, and they can contain contextErrors are reported to Sentry so we can fix them. Stack traces and surrounding diagnostic context can include fragments of what was being processed. This is a genuine residual, not a nil one.
Between two Companions
When your agent talks to a colleague’s.
The one part of the system that is genuinely end-to-end encrypted — and the part of it that is not.
Verified in the source
The relay cannot read the messages.
Each message is sealed with a fresh ephemeral X25519 key, HKDF-SHA256 and ChaCha20-Poly1305, and signed by the sender over the exact ciphertext. The relay stores the sealed envelope and routes on the header. There is no key on the server.
And the residual, named
It does learn who talks to whom.
Sender, recipient, timing, frequency and message size are visible to whoever operates the relay — that is us. Undelivered messages are swept after 14 days. Pairing is invitation-only and out-of-band; there is no directory, and a message from someone you have not linked with is never opened.
One more thing worth knowing before you invite anyone: when a colleague’s Companion asks yours a question, yours answers with your real tools, under a sharing policy you wrote in plain English. An empty policy means “ask me about everything”, never “allow”. Every message sent or received on your behalf is written to a local ledger you can read.
The list we would rather you read here
What it does not do yet.
We are early, and the people we most want using this are the people who check. So here is the list, on the page rather than in a FAQ.
- The model runs remotely.Your data stays local; the question goes to the provider you choose. On-device inference is the next thing we are building, and it is what would make this genuinely air-gapped.
- Memory indexing is not local yet.Semantic search and recall require a network call to an embedding service. Pull the cable and Companion keeps running, but semantic memory search is not available until it is back.
- Sync is not end-to-end encrypted.It is off by default. If you turn it on, conversation content is readable on our relay. We would rather you knew that before you enabled it than after.
- Sign-in uses a cloud identity provider.The data plane is local. Login is not.
- Windows installers are not code-signed.SmartScreen will show an 'unrecognised app' warning, and a managed corporate machine may block the installer outright. macOS builds are signed and notarised. We are fixing the Windows side.
- There is no central administration.No fleet policy, no organisation-wide audit console, no seat management. If you need to administer this across a firm today, it will not do what you need.
- We hold no certifications.Not SOC 2, not ISO 27001, not FedRAMP. We have not begun formal accreditation and would pursue it alongside a first customer who needs it.
- There is an open finding about third-party integrations.Our own defect register carries an open, unresolved issue in how credentials for connected third-party services are held. Until it is closed we would not connect a mailbox or drive containing regulated or client-confidential material — and we would rather say so than let you find out. Everything local to your machine is unaffected. Ask us and we will tell you exactly where it stands.
Why this list exists
A vendor who has never told you a limit has not yet told you anything.
Every product in this category will answer “is my data secure?” with “yes”. That answer carries no information. The list above is the part you can actually use to make a decision, and it is the reason we publish it rather than waiting to be asked in a questionnaire.
Check it yourself
How to verify any of this.
Everything above is observable from your own machine. Companion’s local services listen on 127.0.0.1; your conversations and memory graph are files in your user directory that you can open; and the connections it makes are visible to any network monitor you already trust. If you find something on this page that is wrong, tell us and we will correct the page.