Data and execution boundaries
Local-first does not mean all network communication disappears, and it does not mean content sent to a model provider automatically receives E2EE. Evaluate each data flow separately.
Execution boundary
Claude Code, Codex, commands, tools, and workspace access run on the target CLI device. The App and service do not replace that device by executing local commands in the cloud.
Provider data
Content intentionally sent to the selected model provider is processed according to the current model source, route, provider configuration, and applicable provider terms. An E2EE control channel does not change the fact that the provider processes task content sent to it.
A quick map of the data flow
| Data or action | Primarily handled by |
|---|---|
| Commands, tool calls, and workspace access | Target CLI device |
| App control messages | Encrypted control channel between App and target device |
| Account, device directory, online state, and delivery information | Account service and relay |
| Task content sent to a model | Selected Cloud or other provider |
| Provider credentials, complete CLI state, and local logs | Target CLI locally |
| Status and diagnostic summaries shown in the App | App, limited to what the current operation needs |
Account and relay
The account service and relay may process authentication, device directory, public keys, online state, routing, delivery, abuse prevention, and other necessary runtime metadata. Supported device-control messages may use end-to-end encryption between trusted devices.
Local storage
The target CLI owns the concrete storage scope for provider credentials, CLI state, workspace authorization, policy, and full local logs. The App should present only data needed for the current operation or constrained status summaries.
Public documentation claims
- Do not describe all product data as universally E2EE.
- Do not turn “the server does not execute commands” into “the server sees no metadata.”
- Do not describe a display-safe summary as the complete raw audit log.
- Describe Cloud, remote device, and local provider boundaries separately.