Enforced in the code, not promised in a footer.

Every request and response body on the API is encrypted end to end by middleware, on top of TLS — not just the login call, the whole surface. New endpoints inherit it automatically; there is no opt-out path for a route to forget.

Sensitive content is ciphered before it reaches storage, through the repositories that own it. Chat and Code messages, workspace metadata and generated documents are written encrypted, so a database file on its own is not a transcript.

Provider credentials use their own cipher, distinct from content encryption, and live in one store scoped to your user. They are never logged, never sent to the frontend in the clear, and never placed in an environment variable or an image.

Every API request carries a verified identity token, and ownership is checked in the application layer — never inferred from what the client claims. The frontend caches nothing as truth and re-reads the backend on every view.

File, search, git and language-server tools are confined to your workspace root. Absolute paths and parent-directory escapes are rejected before a tool runs, and containment is re-checked at the filesystem layer.

Your voice is biometric data. Raw microphone capture is pitch-shifted, filtered and downmixed on-device, and the original recording is dropped from memory. Only the modulated audio is ever sent, you preview and edit the transcript first, and no audio is stored or logged.