Skip to main content

Privacy

Belay watches what AI coding agents do on your machine, which means it can see your commands, files, and secrets. Because of that, we hold the product to a simple standard: local-first, and no phone-home by default. This page explains, in plain language, what the software does and does not do with your data.

note

This is a plain-language summary. The full, formal privacy statement lives in PRIVACY.md in the open-source repository and always describes what the software actually does.

The short version​

  • It runs on your machine. The free, open-source Community edition computes its decisions (allow / ask / deny) and stores its state locally. Nothing about your activity is sent anywhere by default.
  • It does not phone home. Out of the box, Belay does not send your code, file contents, commands, prompts, or secrets to Secblok or any third party.
  • Anything that leaves your machine is opt-in. Any feature that transmits data off your device is off until you turn it on, and it only sends what that feature needs — never your file contents, commands, or prompts.

What stays on your machine​

These are processed and stored locally only, under your data directory (~/.belay on Linux and macOS, %ProgramData%\Belay on Windows), and are never transmitted by Belay:

  • The contents of your files, source code, environment variables, and secrets.
  • The text of the commands, tool calls, and prompts your AI agent runs.
  • Your local audit log — the hash-chained record of allow / ask / deny verdicts, stored at ~/.belay/audit.ndjson. Each row carries the previous row's hash plus a SHA-256 over the canonical, key-sorted JSON, so tampering is detectable.
  • Your rules configuration and allowlists, plus the other local config files under ~/.belay (for example ai.json, channels.json, net_enrich.json, ssh_guard.json, and state.db).
  • Your AI-explainer provider key, if you set one — stored owner-only (0600) and write-only at ~/.belay/ai_key, and never logged.

Belay reads these only to make a local security decision. They do not leave your device through Belay.

Notifications are privacy-safe​

When the desktop app raises a system notification (for example, when a deny or ask lands while the window is in the background), the notification shows the category of the event only — never the file path, the command, or the tool arguments. The sensitive details stay in your local audit log; they are not put into OS-level notifications.

The optional AI explainer​

Every verdict already ships with a curated, plain-English explanation computed entirely on your machine. Belay also has an optional AI explainer that is off by default and feature-gated. It is bring-your-own-key (BYOK):

  • Local mode (Ollama) keeps everything on your machine — nothing is sent off your device.
  • Cloud mode requires your explicit consent and your own provider key (Anthropic, OpenAI, Gemini, xAI, DeepSeek, Mistral, Groq, Cohere, Perplexity, Together, OpenRouter, or MiniMax). The key is pasted in-app (stored owner-only at ~/.belay/ai_key) or supplied via BELAY_AI_KEY, which takes precedence over the in-app key file. Data goes to the provider you chose, under your own account and their terms — not to Secblok.

Before anything is sent to a cloud provider, secrets and host paths are redacted. The AI explanation is advisory only: it never makes or changes a decision, and any error falls back silently to the curated, local explanation. No key means no external calls.

The scanner's optional --llm cascade​

The static scanner (scan) is fully local and deterministic by default. It analyzes code with pattern, AST, taint, YARA, and OSV analyzers entirely on your machine.

The scanner has an optional --llm flag that can use a language model to help filter out false positives. This only sends code to a third-party LLM provider if you supply the API keys yourself:

  • If you configure a provider key (for example, an Anthropic or OpenAI key), the scanner may send the relevant code snippets to that provider you chose so it can judge findings. That data goes to the provider under your own account and their terms — not to Secblok.
  • If you configure no API keys, the cascade falls back to a local heuristic provider and produces output identical to the deterministic path. In that case nothing is sent off your machine.

You are always in control: no keys means no external calls.

Messaging channels and egress enrichment​

  • Messaging / approval channels are opt-in. When you enable a channel, ask prompts (and notifications) are sent to the chat service you configured — Telegram, Discord, WhatsApp, Matrix, Mattermost, Slack, ntfy, Microsoft Teams, WeCom, or a generic webhook. That traffic goes to the provider you chose, not to Secblok, and only enrolled, owner-approved principals can act on a prompt.
  • Egress destination enrichment (netenrich) is off by default. When enabled, it resolves reverse-DNS hostnames and ASN/owner/country for outbound destinations using public DNS (no API key, no bundled data). It is display-only — it never gates a decision.

Updates and rule feeds​

If you choose to enable update checks or subscribe to a managed rule feed, Belay will contact a download endpoint to fetch the new version or rule pack. Like any download, that request necessarily includes your IP address and basic request metadata — but not your activity data. If those checks are disabled, no such request is made.

The Enterprise management plane​

The proprietary Enterprise fleet, central-management, and compliance components are self-hosted by the customer. Audit and policy data that agents send to a fleet server stay within the customer's own infrastructure — Secblok does not receive it.

Questions​

If you have a privacy question or request, contact hello@secblok.io. The full statement, including your rights and the applicable law, is in PRIVACY.md in the open-source repository.