Local mode:zero egress, no training.

Only what an agent or a human explicitly hands to a Zephr tool call, the file paths, line ranges, and content digests for the anchors a claim cites, and the Git metadata (commit SHAs, branch, worktree identity) for the admitted worktree. The project boundary is approved once, and nothing outside it is read.

Zephr does not silently read arbitrary files, your terminal history, clipboard contents, or secret values. There is no background indexer in local mode — if no tool call was made, nothing was read. Fleet holds references to secrets, never the values themselves.

Local evidence and semantic data live in a single SQLite file on your disk, default path ~/.local/share/zephr/zephr.sqlite, with sqlite-vec for vector search. The store also creates the standard -wal and -shm sidecars at runtime.

Managed cloud is a separate, opt-in path: there the same ledger shape lives in Postgres with pgvector. Signing key material is held locally at POSIX 0600, owner-checked, and exactly 32 bytes.

No. A connection admits exactly one installation, project, and worktree, once, before any tool call — and that binding is immutable for the connection’s lifetime. A claim recorded in one worktree is invisible to a session admitted into another.

Foreign-scope reads are refused at the MCP transport before the tool executes, not filtered out after retrieval. Inclusion is the explicit act; exclusion is the default.

In local mode, the Ed25519 signing key is generated on your machine and never transmitted. It is stored at POSIX 0600, owner-checked, exactly 32 bytes, and verifiable with zephr key-check without printing key bytes.

There is no Zephr-held recovery copy, no escrow, and no second copy anywhere. The lost-key consequence sits beside the custody fact: a lost key is genuinely lost.

Managed cloud is a separate, opt-in path with per-tenant envelope encryption, and signup is live at app.zephr.ai.

When you move an evidence bundle between tools or machines, Continuity Format seals it. The receiving side authenticates before it parses — the packet is proven intended for that installation before any of its content is interpreted.

An Ed25519 source signature proves which pinned source signed the canonical payload; a destination-bound HMAC-SHA-256 proves the packet was intended for the receiving installation; manifest roots are recomputed from canonical bytes, never trusted from the packet’s own fields; and one-time consumption is enforced by an atomic ledger, so a replayed packet is rejected outright.

Continuity export is available: the open continuity format means your ledger is machine-readable and portable, so leaving is a supported operation.

The current deletion limitation sits directly beside it. Lifecycle uninstall removes the primary SQLite store file after a readiness check and an explicit confirmation. The full governed purge of WAL/SHM sidecars, temporary files, caches, staged exports, and OS-held key material remains incomplete according to docs/security/local-privacy-operations.md. Calling the current command full erasure would be a claim without an artifact.

No — for local mode, as an architectural consequence rather than a policy promise. The file is on your disk, the gateway is loopback-only, and there is no account linking it to us. We never receive it, so there is nothing for staff to access.

The same-UID process-isolation residual sits beside that fact: stock POSIX does not isolate two processes running as the same user, so another program running as you can reach the same files you can. It is an open residual, stated plainly.

None, on the local path. The default embedding lane runs on-device and sends nothing out. There is no provider fan-out: a request goes to the one selected allowed provider, and provider events record the model, region, prompt digest, and policy decision — never the prompt or response content.

Managed-cloud services are a separate, opt-in path. For the broader provider list, retention terms, and forbidden data classes, see /security and /privacy.

Four structural controls reduce the authority and propagation of injected text: provenance is required before a claim carries weight (a memory with no source is an unanchored opinion, not a fact); review state is a separate, attributable human step (capture never confers trust); contradiction surfaces rather than silently resolving (recall returns the contradiction, not the newer or more confident-sounding text); and foreign-scope exclusion keeps a poisoned repository from reaching across a binding boundary.

These controls reduce authority and propagation; they do not claim immunity from prompt injection. Model-assisted injection containment is a precondition for T3 judgement in ADR-Z-07, and T3 is not built — there is no shipped control there and no measured resistance to report.

Project and worktree boundaries: only approved projects are admitted, and trust rules are configured per worktree (capture limits, required provenance, permitted review states, contradiction handling). A path you never bound is unreachable.

Secret-value exclusion: Fleet holds references, never values, so secret material never enters the ledger. Hosted processing is optional: the local on-device embedding lane is the default, and hosted embedding providers stay disabled until an organisation explicitly opts in.