Privacy

Privacy

Aperio is designed to be fully air-gapped by default. Your data never leaves your machine unless you explicitly configure it to.

---

Default: Zero network calls

With default settings (AI_PROVIDER=llamacpp, EMBEDDING_PROVIDER=transformers):

• No API keys needed
• No data sent to any external service
• No telemetry
• No analytics
• No phone home

Everything — AI inference, embeddings, database, MCP server — runs on your machine.

The only network activity is:

• Model download on first use (HuggingFace via llama.cpp)
• Optional: Web search (when you use the web_search tool)
• Optional: GitHub API calls (when you use GitHub tools)

---

Cloud providers

If you switch to a cloud AI provider (AI_PROVIDER=anthropic, deepseek, or gemini):

What leaves your machine:

• Your chat messages (sent to the AI provider's API)
• The system prompt and context (memories, wiki articles relevant to the query)

What stays on your machine:

• Your database (all memories, wiki, code graph, document graph)
• Your files
• Your configuration

---

Embeddings

Transformers.js (default): Fully local. The embedding model runs in JavaScript. No data leaves your machine.

Voyage AI (optional): Only the raw text of each memory being saved is sent to Voyage's API. Conversations, other memories, and personal files are never sent.

See Embeddings for details.

---

Database encryption

Optional AES-256-GCM encryption for the SQLite database:

APERIO_DB_ENCRYPT=on

The encryption key is stored in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service).

---

Authentication

Optional shared-secret token for API access:

APERIO_AUTH_TOKEN=your-secret-token

When set, all API and WebSocket requests must include the token.

---

Telemetry

Aperio collects no telemetry. There is no analytics SDK, no usage tracking, no crash reporting to external services.

If something breaks, it's logged locally in var/logs/.