Privacy & Security Boundary

Praxis is local-first. Compilation runs entirely on your machine, and your source code never leaves it. This document states exactly what stays local, what leaves, and when — grounded in the actual behavior of the CLI, not aspirational policy.

1. The core boundary: your code stays local

praxis build is deterministic, offline, and uses no LLM (ADR-0005). It scans the repo, extracts an evidence-cited knowledge graph, folds certified skills, and seals a Company Brain artifact — all on your disk. Raw source is never uploaded, and no third-party service sees it.

The Company Brain that results is a derivative: evidence-cited claims and certified skills with permalinks back to your source. It is not your source code.

2. What leaves your machine — and only when you ask

Nothing in the table below happens during praxis build. Each is triggered by an explicit command or an explicit connector choice.

Partner data rule (ADR-0006): private partner data must run deterministic-only or local Ollama — never a third-party LLM API. praxis build honors this by design (no LLM at all); the third-party connectors under ask are an explicit, opt-in choice for public/non-sensitive queries.

3. Telemetry: local-only, never transmitted

Praxis records a few operational counters on your machine — how many builds you ran and how many times an agent read a certified skill — plus the compiler/brain-health/runtime structure the service defines. These are written to ~/.praxis/telemetry.json and never leave the machine: there is no network path, no HTTP client, no endpoint. This is asserted by a test that fails if any recording path opens a socket, not left to intent (ADR-0008).

No source code, no prompts, no file contents, no tokens, no identities ever collected.

This is stricter than the residency boundary in section 5: ADR-0006 lets the sealed brain cross on explicit push; telemetry crosses never.

Opt out — one authoritative switch, two ways to set it, both reading ~/.praxis/config.json:

praxis config set telemetry off      # turn back on with: praxis config set telemetry on

or set PRAXIS_TELEMETRY=0 in the environment. When disabled, no counter is recorded and ~/.praxis/telemetry.json is not created.

4. Local storage

PRAXIS_BRAIN_DIR overrides the brain location. Credentials and tokens live only in environment variables or these local files — never checked into a repo, never embedded in the brain artifact.

5. The sealed-artifact guarantee

praxis push publishes the sealed brain artifact to the gateway — the intended step for cloud serving and team sharing. Note that it also removes the local brain directory after a successful upload unless you pass --keep. The gateway serves it statelessly, runs no inference, and never receives a raw repo. The boundary is that your source never leaves your machine — not that the certified brain doesn't; publishing the brain is exactly how a team serves the same certified skills to everyone. The seal (a content hash over the artifact) is verified on load, so a served skill is provably the one that was certified. The gateway is self-hostable for privacy-max deployments (in which case the brain stays on your own infrastructure).

6. What this document does not claim

In the spirit of the project's honesty gate, this is an engineering description of current behavior — not a legal or compliance certification. It makes no claim of GDPR, SOC 2, HIPAA, or any formal certification, and no claim of encryption-at-rest beyond your own filesystem's. Treat the boundary above as the accurate, verifiable one.