What Agentrails reads and stores.
Agentrails captures only approved provider sources. This page separates the encrypted raw archive, readable local search data, explicit exports, and the cloud features that are still disabled in v0.1.
Inputs
Nothing signs in on your behalf.
Agentrails accepts official hooks, documented local history, public SDK events, and official exports you select. It does not scrape provider web apps or call undocumented private endpoints.
Agentrails never reads
- Browser cookies or local browser storage
- Account session tokens
- Private provider API responses
- A provider source that has not passed the adapter gate
Local data
Originals and search data stay separate.
Agentrails gzip-compresses raw captures and encrypts them with AES-256-GCM. It redacts normalized content before writing messages, titles, paths, and event data to the local SQLite search index.
Pending queue jobs, the search index, and plaintext exports remain local plaintext protected by filesystem permissions. In v0.1, the encryption key is an owner-readable file beside the archive. Malware running as the same user can read both.
When a provider supplies explicit attachment bytes, Agentrails stores them as separate content-addressed encrypted objects. It does not follow remote URLs or copy an arbitrary workspace file just because an agent mentioned it.
Immutable files in the local archive
Gzip compression and AES-256-GCM encryption
SQLite full-text index
Redacted local plaintext with filesystem permissions
Files in the local queue
Local plaintext with owner-only permissions
Markdown, JSONL, or portable ZIP
May contain plaintext and must be handled as sensitive
Limits
A captured trace can still be incomplete.
Providers decide what their hook, local history format, or export exposes. Agentrails cannot recover hidden system prompts, internal model state, events omitted by the provider, or files that were only referenced by path.
Each thread records its capture method, visible-message coverage, and adapter warnings. A live completion hook describes when Agentrails was notified. It does not claim that every intermediate provider event was available.
Local encryption protects archived files at rest. It does not protect against malware or another process already running with access to your operating-system account.
Cloud storage
Bucket verification works. Archive transfer does not.
You can link and verify a private bucket from any supported S3-compatible provider. Agentrails writes a random probe, checks its size, downloads and compares every byte, then deletes it. The probe contains no transcript data. Automatic archive upload and clean-device restore remain disabled until recovery keys, manifests, retries, and restore tests are ready.
The local search index will not be uploaded.
Security
Report private data bugs privately.
Do not put real transcripts, credentials, private paths, or exploit details in a public issue. Use GitHub's private vulnerability reporting flow.