---
title: Trust & Security
url: https://arcana.otnelhq.com/docs/trust-boundaries
---

# Trust & Security



Arcana is a terminal-native tool that runs on your machine. Understanding what it can read, write, remember, and expose is critical for using it safely — especially in enterprise environments.




## Core Principle: BYOK, Local-First



Arcana follows a **bring your own key (BYOK)** model. Your API keys, sessions, memory, and code never leave your machine unless you explicitly enable cloud sync or the proxy API.




## What Arcana May Read



| Data | When | Where it goes |
| --- | --- | --- |
| Files in your project | When you ask it to analyze code | Sent to your configured LLM provider |
| Shell output | When tools execute commands | Stays local (sent to LLM only if agent reads it) |
| Git history | When reviewing commits/PRs | Sent to LLM provider |
| Environment variables | At startup for provider detection | API keys sent to respective providers |
| Skill files (SKILL.md) | When skills are loaded | Included in system prompt to LLM |
| Memory database | At session start for context | Relevant facts included in prompt |




## What Arcana May Write



| Data | Location | Can be disabled? |
| --- | --- | --- |
| Session transcripts | `~/.arcana/data/sessions/` | No (required for history) |
| Memory facts | `~/.arcana/data/memory.db` | Yes (`memory.enabled: false`) |
| Cron job definitions | `~/.arcana/data/cron-jobs.json` | Yes (don't create jobs) |
| Workspace trust fingerprints | `~/.arcana/workspace-trust.json` | No (security requirement) |
| Skill cache | `~/.cache/arcana/skills-cache.json` | No (auto-rebuilt) |
| Project files | Your working directory | Only when you approve tool calls |




## What Arcana Remembers



Memory persists across sessions and includes:



- **Extracted facts** — key decisions, architecture notes, conventions
- **Skill usage stats** — which skills you use most often
- **Session metadata** — timestamps, token usage, model used



Memory is stored locally in SQLite. It never leaves your machine unless you enable [cloud sync](/docs/memory#cloud-sync).




## What Arcana May Expose



| Data | When | Mitigation |
| --- | --- | --- |
| API keys | Sent to LLM providers for inference | Use env vars, never commit to git |
| Code snippets | Sent to LLM provider when analyzing | Choose providers with strong data policies |
| Memory facts | If cloud sync is enabled | Disable cloud sync if sensitive |
| Gateway messages | Chat platforms (Telegram, Discord, etc.) | Use allowlists to restrict access |




## Tool Permissions



Arcana's tools (shell, filesystem, git, MCP) require explicit permission. You control access through:



- **Interactive approval** — default mode, asks before each tool call
- **Workspace trust** — `arcana trust` allows project-level extensions
- **Autonomy modes** — from read-only to full execution
- **Gateway allowlists** — restrict who can interact with your agent




## Data Residency



- **Local by default** — all data stays on your machine
- **Provider egress** — prompts are sent to your chosen LLM provider
- **AWS Bedrock** — data stays within AWS (no external egress)
- **Ollama** — fully local, no data leaves your machine at all




## Enterprise Considerations



- Use `ARCANA_DISABLE_WORKSPACE_TRUST=1` to skip trust checks in CI
- Use `ARCANA_TRUST_WORKSPACE=1` for automated environments
- AWS Bedrock + IAM provides the strongest data residency guarantees
- Disable cloud sync and gateway for air-gapped environments