What goes where
Security and data
Where your data goes, what stays on your machine, and what we do not claim.
Where your data goes
| What | Where it lives | Does it leave your machine? |
|---|---|---|
| Your source code | Your disk | Not to be worked on — agents operate on it in place. The search index is the exception; see the last row |
| File reads and writes by agents | Executed on your machine | The operation crosses the tunnel; the file does not get uploaded wholesale |
| Your conversations | The brain, and your machine | Yes — this is the chat itself |
| Prompts and model responses | Between the brain and the model endpoint you chose | Yes, to your chosen provider |
| Your model API key | Stored encrypted and used to call your provider | Only to your provider |
| Scratch work (scripts, media) | Free tier: your machine. Paid tier: our cloud | Depends on your tier |
| Device context — platform, timezone, locale, app version | Sent with your turns so answers can use them | Yes, to the brain |
| Your location (GPS) | Collected only if you turn it on in settings, and sent as part of that device context | Only if you enable it. Off unless you choose otherwise |
| Third-party integration credentials | Held by the integration service | Only to the service you connected |
| Code search index | Chunks of your code, their embeddings and a map of its symbols, held by the brain so search and codebase questions can work | Yes, and automatically — linking a project folder indexes it, which copies those chunks. Embeddings are computed by whichever embedding endpoint you configure, including one on your own hardware |
The network model
Your machine makes outbound connections only. The bridge that lets the platform act on your machine is dialled from your app to the brain, and every operation travels back down that same connection.
Practically:
- No inbound ports
- No firewall exceptions
- No requirement for a public IP or a tunnel service
- Nothing on your machine is addressable from the internet because of WorkByte
Choosing where your model runs
If sending prompts to a third-party provider isn't acceptable for your work, point WorkByte at a model on your own network. Inference requests route over your bridge to that endpoint, so the model stays inside your perimeter and its address never needs to be public.
What we do not claim
- No security certification. No SOC 2, no ISO 27001.
- No compliance claim. Not GDPR, not HIPAA. If you have a hard requirement, get in touch before you rely on us for it.
- No uptime SLA for the hosted brain.
Reporting a security issue
Found something? Email workbyte.in@gmail.com and we'll look at it.