Docs / Reference
Security and privacy
Where your keys and data live, what leaves the machine, and what to watch for.
This page says plainly where your data lives, what leaves your machine, and what Rescriptum does and does not protect.
What stays on your machine
- Your source code. It is read from and written to your own disk.
- The symbol index, memory, scratchpad, checkpoints, and cost ledgers.
- The session record behind Traces: tool calls, failures, and previews of their output, stored under
.rescriptum/in the project. It is read locally by the panel and by the agent's own review tools and is never uploaded. - Your API keys. They are stored locally and sent only to the provider they belong to. Rescriptum's servers do not receive your model keys.
What leaves your machine
| Destination | What is sent | When |
|---|---|---|
| Your model provider (OpenRouter, a provider you added, or a local server) | Your prompt, the code and tool output the agent included in context, and the conversation | Every model call |
| Search and fetch services | Queries and URLs | When the agent uses web_search, web_fetch, or research |
| MCP servers you connect | Whatever arguments the agent passes to their tools | When the agent calls them |
| Sign-in service | Your login and plan information | When you sign in. Continue offline skips this |
rescriptum.com | A request for the latest release list | When checking for updates |
| Cloud providers | Deploy contents, database requests, .env sync | Only when you use the Cloud panel or its tools |
The first row is the important one. Whatever the agent reads can be included in the request to your model provider. To keep code private, use a provider whose terms you trust, or a local model.
How keys are stored
Keys are currently stored as plain JSON text in your Windows user profile:
- The OpenRouter key in
%APPDATA%\rescriptum\config.json - Your own providers' keys in
%APPDATA%\rescriptum\providers.json - The sign-in session in
%APPDATA%\rescriptum\auth\session.json
They are protected by Windows file permissions for your account, not by encryption. Any program running as you can read them. Practical advice:
- Turn on full-disk encryption (BitLocker) on any machine that holds keys.
- Do not sync, back up to shared storage, or commit
%APPDATA%\rescriptum. - Use keys with spending limits and rotate them if a device is lost.
- The UI never shows a saved key again, only a short preview.
Project .env files are a separate matter. They hold your project's secrets. Keep them out of git.
The local agent
The agent can run commands as you, so it is gated.
- The command policy classifies every shell command. Destructive patterns are always denied.
- Edits outside the project folder are blocked, and read-only paths cannot be changed.
- Presets and auto-approve control how often you are asked. Strict blocks MCP tools and web search.
- File edits are snapshotted before they happen, so a turn can be rewound.
None of this stops side effects outside your machine, such as a deploy or a call to a remote API. Treat auto-approve with that in mind.
The browser link
The Neuro-Bridge listens on 127.0.0.1:49281, so only your machine can reach it. It checks the origin of WebSocket connections and accepts the Rescriptum Tab extension, the IDE itself, and local development origins. It has no pairing token. File access over the bridge is restricted to relative paths inside the open project. While Tab is linked, the IDE can share your OpenRouter key with the extension over this local link. See Rescriptum Tab.
Builds
Windows builds are currently unsigned, so SmartScreen warns on first run. Check the SHA-256 on the download page before running.