Privacy and data

In 0.1 your assistant’s data lives on the computer where you hatched it. Linux first: instance files under ~/.local/share/cadence/assistants/. There is no Aevum-hosted Cadence Cloud workspace and no WorkOS tenant for this product.

The model still has to run somewhere. If you point at Hive (or another local OpenAI-compatible endpoint), inference stays on your network. If you paste a remote provider key, conversation context goes to that provider for the turn. You choose that hop.

What stays on your machine

Workspace files

IDENTITY.md, SOUL.md, USER.md, NOW.md, skills, data. Loaded into model context when a turn needs them. They do not upload to an Aevum cloud.

Memories

Concept pages and the memory store. Recalled when relevant. See Memory and context.

Conversation history

Messages, tool calls, results. Current thread, compacted when long.

Trust rules

Owned by the gateway. Not sent to the model.

Configuration

config.json in the workspace.

What leaves the assistant

• Model calls. System prompt (from workspace files), current conversation, recalled memories, tool schemas, and tool results go to the model you configured. Hive: your LAN. BYO remote key: that vendor’s API. Cadence does not insert a metered Aevum inference proxy in 0.1.
• Channel messages. If you connect Telegram, Slack, email, or Twilio, those platforms see the messages you send through them. See Channels.
• Tool network calls. Web search, fetching a URL, provider APIs. Credentials for those calls are injected at the network layer. The assistant never sees the raw secret.

Aevum does not receive your workspace, memories, or credentials as a hosting provider in 0.1. Optional crash or feedback upload is a separate, explicit action if you use it.

How credentials are protected

API keys, OAuth tokens, and similar secrets live in the Credential Execution Service (CES), a separate process with its own encrypted store. The assistant talks to CES over a controlled interface and never reads the values.

• Isolation. CES storage is not the workspace. The model cannot open keys.enc.
• Network injection. Authenticated HTTP gets the token at the proxy. The assistant only knows an alias.
• Collection. Use the credential prompt (or the channel-setup UI). Never paste secrets into chat. cadence credentials set will not take a secret typed in an agent shell.

How secrets are caught

A scanner looks for known secret shapes on ingress and in tool output (API keys, tokens, private keys, connection strings). Allowlists cover known false positives. This is a safety net. The real defense is not putting secrets in the conversation in the first place.

Who can access what

• Guardian (you): full access to memory, workspace, credentials, tools, config. One guardian per hatch.
• Trusted contacts: people you verified on a channel. They can talk and use allowed tools. They cannot read your memories, workspace files, or host tools without you.
• Unknown contacts: unverified. They hit a channel-appropriate challenge (invite code, or outbound voice on phone) before any access.

Private conversations

A private conversation has its own memory scope. What it saves stays in that thread. It can still read shared memory. Use this when you do not want a topic filed into the broader graph.

The model provider

What gets sent on each turn: the assembled system prompt, current (possibly compacted) history, retrieved memories, tool definitions, and recent tool results. Credentials, trust rules, and raw CES material are never in that payload.

Retention and training policy are the provider’s, not Cadence’s. Read the notice for the API you actually call. Hive on your hardware is your own operational choice.

Product legal pages (terms, privacy policy) are unpublished for 0.1. This page is how the software treats data, not a contract.

What you can do

• Use private conversations for sensitive topics.
• Never paste secrets in chat. Use the credential prompt.
• Review USER.md and SOUL.md. Those files ride along on turns.
• Ask the assistant to delete a memory, or “show me what you remember about X.”
• Keep high-risk trust rules narrow. See The permissions model.

Hosting detail: Local hosting.