Safety

What Vults promises:

• It never blocks your agent. If the app is closed, slow or broken, the hook exits within milliseconds and prints nothing, and your agent asks in its terminal as usual.
• Only you answer a permission. No timer or default ever answers one. Besides your click, only these do: an exact rule you made with Always, for that command or file; a policy you wrote, saw as a diff and accepted with a click (a deny beats an allow); a phone you paired, when its answer is signed by its key for that very card, in time, never seen before (approving needs your biometrics on the phone, denying does not; see The phone); and, in Zeca’s chat only, the access you chose for its cards (Who answers Zeca’s cards); under its full access, a policy’s deny or ask still holds, and content from outside brings cards back. A destructive call (rm -rf, a forced push) always asks: its card offers no Always, and no rule, policy or full access ever answers it. A question from Claude Code is answered only with the choice or the words you gave on its card.
• Only your user account can talk to it. The socket lives in your private runtime folder with mode 0600, and both ends check the other process runs as you (on Windows, by SID).
• It never edits an agent’s config behind your back. Every change gets a dated backup and a diff you approve; hooks from other tools are kept, a Claude Code status line of your own keeps running (how), and Codex’s trusted_hash is never written (you trust our hooks yourself, in Codex’s /hooks).
• Plan usage comes from the CLIs only. Claude Code’s status line input is cut down in the hook to its rate_limits and the session’s cost before anything leaves it; Codex is asked with a read-only call, only while Settings → General → Codex usage is on.
• The chat uses the CLIs you logged into (claude, codex), and Vults never reads their credentials; every command and edit your own rules don’t allow waits for your Allow (see Your setup).
• API keys stay in your OS keyring. If you give the chat a provider’s API key, it is written only to the keyring (Secret Service on Linux), never to a file or a log, never sent back to a window, and only ever sent to that provider. Local models (Ollama, LM Studio) are reached on 127.0.0.1 only. The API chat can’t run commands or edit files. Its tools read what the island shows (sessions, cards waiting, usage, your GitHub card); with the memory on, recall reads the journal and memory_propose writes only a proposal; with the web on, it gets the web tools. What they return goes to that provider with the conversation, commands with their secrets redacted.
• Each chat message says what the island shows. Through a CLI or an API, a message to Zeca carries the date and time and a line for each session (agent, project, state, its step with secrets redacted), never a card’s command. With the memory on, what Zeca remembers joins when a conversation starts, and up to 3 recalled passages go with each message.
• The microphone only listens while you hold a recording. Voice is off until you download a model; then the mic records into memory only while its button is red (a minute at most), and whisper.cpp transcribes it on this computer. The audio is never saved or sent anywhere.
• Now playing is off until you turn it on. Then the app reads your media players over the session bus (MPRIS on Linux) to show the song; it is never stored or sent anywhere.
• What the app asks on its own goes through one gate. A request made without a click at that moment (a connector’s check, the Codex usage read, a paired phone’s cards and answers, the web tools, the journal summary, memory suggestions and Zeca’s sleep) asks the app’s network gate first: only a feature you switched on, each with its own daily cap (see the table), each request kept as a line in vults.sqlite (when, which feature, whether it answered; 30 days). A connector over its cap waits and says so in Settings → Connectors.

What it keeps stays on this computer, is never sent anywhere, and is listed in Settings and files; Clear history removes most of it:

• The edits it shows stay in memory: a finished edit’s changed lines (400 at most), for the session’s last steps, never written to a file or a log.
• Connectors keep only their last answer, so a restart does not replay old news (Connectors).
• The activity history is counts: never a prompt, a reply, a command, a file name or a path (Activity).
• Zeca’s turns are traced for 30 days: engine, model, tokens, cost and each tool’s redacted target, never a prompt or a reply (The Nest).
• Zeca’s conversations are kept, the newest 200, never a card’s answer nor an Always in this chat rule (Conversations).
• Zeca’s memory is off until you turn it on, and only you write it: what Zeca, a model or his MCP server would add waits for your yes, and a project’s CLAUDE.md changes only over the file you saw, after a dated backup (Zeca’s memory).
• Every answer is on record. An audit log keeps, for 90 days, each answer to a card, the flock’s and Zeca’s chat’s: who gave it (you, your paired phone, an Always rule, the chat’s Always in this chat, a policy with its consent, the chat’s full access, or the app when a card’s time ran out or Paused sent it to the terminal), what it did (allow, deny, always allow, allow in this conversation, answer, send to the terminal, or time ran out), the agent, the project’s folder name, the tool and the exact command or path, with tokens and NAME=secret values redacted first. An answer given in the agent’s own terminal is not in it. Each agent config the installer writes is kept too. A line is never changed and none leaves before 90 days, except through Clear history, which leaves one line: that you cleared it, and when. It is always on.
• What you agree to is kept for good. Each policy you accept is a row in vults.sqlite’s consents: when, what it is about, the words you accepted and a SHA-256 of the diff you saw. A row is never changed or deleted, and Clear history does not touch it: a policy must never lose the proof that you said yes. Revoking turns the policy off at once; the row stays, marked revoked. The row’s words are the policy itself, and one whose diff does not end at those words never answers.
• Secrets stay in your OS keyring, and there is no telemetry.

Every request Vults makes

#

Nothing else reaches the network. CI checks it: scripts/check-network.sh fails on a crate that depends on an HTTP client, or a file that names one or starts a network command, outside scripts/network-allowlist.txt, which names each one and why; and on a webview allowed to connect anywhere but the app.