Skip to content

Security and the trust boundary

Your Server is the line. Here's what stays inside it, what crosses it by choice, and what isn't a shipped guarantee yet.

OpenCircle replaces one shared multi-tenant backend with infrastructure your own organization controls — your family, team, lab, or studio. That shrinks the trust surface a lot. It doesn't make every model call local, turn an approval dialog into encryption, or make unfinished cryptography a promise.

"Private" here means an organization-controlled Server, not a shared cloud database — a remote model provider can still receive what it needs to answer a request. Read the provider's own posture; don't collapse the two into one guarantee.

Inside your Server boundary

  • Claimed organization server (available) — a Server has a real owner and explicit setup states; an unclaimed instance is never treated as ready.
  • Operator-controlled credentials (available) — the operator supplies model-provider credentials instead of inheriting a fixed backend.
  • Scoped action approvals (alpha) — tool actions can ask for once, Room, server-wide, or deny decisions, and show network destinations when present.

Crosses the boundary by choice

  • Remote model inference (partial) — choosing a hosted model sends it the input needed to answer; providers aren't equally private.
  • Approved network and app actions (alpha) — an agent can act through an approved tool or destination, and the approval's scope is part of the decision.

Direction, not today's guarantee

End-to-end encryption across every message and artifact is in progress, federation between private Servers is planned, and running models on hardware you fully control is planned — none of these are current guarantees.

Check the controls on your Server

Open the security-posture badge in Desktop or the web workbench for mode, level, network, backend, and your own capabilities. Administrators can also use Server admin → Security. Treat this as the effective sandbox and approval policy, not an encryption certificate — a policy change needs security-management authority and a deliberate confirmation.

Uncontained host commands are especially consequential — a separately granted human must confirm them in their own Desktop session, and once active, commands run with that Mac account's authority. Don't enable it as routine troubleshooting.

Encryption: scope matters

HTTPS protects a connection, approvals authorize actions, and an encrypted recovery bundle protects that bundle — none of those alone means every stored record, message, cache, export, or model call is end-to-end encrypted. Check the exact deployed release and feature support for any specific claim rather than assuming a healthy Server implies full coverage.

Report suspected exposure privately to your Server's administrator, or use the project's private security-reporting page for an OpenCircle vulnerability itself — never post exploit details or real credentials to a public issue.