Privacy
Your archive stays yours.
Agentrails captures only approved provider sources. Raw captures are encrypted. The redacted search index stays on your device.
Inputs
Nothing signs in on your behalf.
Agentrails accepts official hooks, documented local history, public SDK events, and official exports you select. It does not scrape provider web apps or call undocumented private endpoints.
Agentrails never reads
- Browser cookies or local browser storage
- Account session tokens
- Private provider API responses
- A provider source that has not passed the adapter gate
Local data
Originals and search data stay separate.
Agentrails gzip-compresses raw captures and encrypts them with AES-256-GCM. It redacts normalized content before writing messages, titles, paths, and event data to the local SQLite search index.
Pending queue jobs, the search index, and plaintext exports remain local plaintext protected by filesystem permissions. In v0.1, the encryption key is an owner-readable file beside the archive. Malware running as the same user can read both.
Cloud storage
Bucket verification works. Archive transfer does not.
You can link and verify an S3-compatible bucket. Agentrails writes a random probe, checks its size, downloads and compares every byte, then deletes it. Archive upload and clean-device restore remain disabled until recovery keys, manifests, retries, and restore tests are ready.
The local search index will not be uploaded.
Security
Report private data bugs privately.
Do not put real transcripts, credentials, private paths, or exploit details in a public issue. Use GitHub's private vulnerability reporting flow.