Security and Credentials

Security and Credentials

Credential storage

• API keys live exclusively in the OS secure keyring — never in SQLite, logs, or source, and never hardcoded.
• SQLite holds only non-sensitive provider metadata (name, display_name); providers.name is the keyring namespace key.
• Keys are resolved inside the Rust backend and never cross the IPC boundary; users add, update, and remove them through credential management, and missing credentials are detected before any request is sent.

Data handling

• Everything else (conversations, messages, prompts, settings, attachment metadata, agent run/step history, permission rules, tasks, locks, usage counts, debt items) lives in the single local SQLite file. No accounts, no shared workspaces, no background sync.
• User data leaves the machine only in an AI request the user initiated, to the selected provider.
• Permanent deletion requires explicit user action (typed confirmation for full wipe); deletes are hard deletes with cascades, no soft-delete retention. Deleting a conversation removes its messages, attachments, agent runs, and tasks.

Error and log hygiene

• Errors surfaced to the UI are classified and secret-free: no credentials, SQL, or message content. Provider failures distinguish network, rate-limit (with Retry-After), outage, rejected credential, invalid request, and unexpected response.
• Logs support debugging and diagnostics but must never contain sensitive information.
• Local-only usage counts (usage_ledger) record event kinds and day buckets only — titles, prompts, bodies, URLs, and error text cannot be recorded there by construction.

See also: Providers-and-Models, Database, Product-Overview.