Security

What leaves your machine

Three places the app contacts on its own

Cerevisor records usage data on your machine and sends none of it to Cerevisor.

• Update check. When the app starts, it asks releases.cerevisor.com whether a newer version exists. The request carries your IP address and a random id created on this computer, and none of your work. Turn it off in Settings, Updates, "Check for updates automatically".
• Licence validation, only if you activated a paid plan. Your licence key and a hashed name for this computer go to Lemon Squeezy when you activate, and your licence key and an instance id about once a day after that. No content and no usage data go with them.
• The skill-matching model. With semantic skill retrieval on (the default), the app downloads a model of about 23 MB from Hugging Face the first time it starts, then loads it from your disk. Turn it off in Settings, Skills, "Semantic skill retrieval".

Everything else goes to services you set up yourself, such as the model providers you connected, MCP servers you enabled, and any web address you put in a hook.

Cerevisor calls your model providers with your own keys or sign-ins: when an agent runs, when you use the chat builder, for background work such as a run's retrospective, and to list a provider's models. That traffic goes straight from your machine to the provider.

Where your data lives

On your device, in folders you can open

Cerevisor keeps its data in one folder in your home directory, ~/.cerevisor. Workflow files are saved wherever you choose.

• ~/.cerevisor/memory holds your profile, your notes, and what Cerevisor has learned while running your workflows.
• ~/.cerevisor/audit-logs holds one log per run.
• ~/.cerevisor/skills holds the skills you create in Cerevisor. The app also picks up Claude Code skills in ~/.claude/skills.
• Secrets you save in the vault are encrypted with your operating system's key store (Keychain on macOS, DPAPI on Windows). On Linux without a keyring service, they are stored unencrypted in your user folder.

See, export and delete it

• The Inventory tab in the Memory view lists every memory record: what it is, where it came from, when it was made, and what it may be used for.
• "Export everything as JSON" writes a copy of your memory and consent history to your Downloads folder. Cerevisor never sends it anywhere.
• You can delete any record there. A soft delete keeps a row for the audit trail; a hard delete removes it entirely.
• Every consent setting that would let data leave your device is off by default, and each change to one is logged with a timestamp.
• Uninstalling leaves ~/.cerevisor and ~/.claude/skills in place. To remove your data too, delete those folders after you uninstall.

You decide what agents may do

Three approval modes, and limits that hold when nobody is watching

• Oversight. Every tool call asks for your approval first, reads included. A good start for a new workflow or for sensitive files.
• Auto, the default. Reading, searching, writing, editing and safe commands run on their own. Consequential actions, such as deleting files, sending anything or using an untrusted integration, ask first.
• Hands-free. Agents never ask. Switching it on needs a one-time confirmation, and the limits you set in Settings for files, shell, web and git still apply.

In a run nobody is watching, such as a scheduled run, anything that would have asked you is refused instead.

Stop cancels every running agent at once. You can also pause a run and resume it.

MCP servers start untrusted: in Auto mode, their tools ask before they run until you mark a server as trusted. A switch per workflow in Settings, Permissions turns MCP tools off entirely.

Before you schedule a workflow, set a budget cap for it or its pipeline, so an unattended run cannot run up costs.

How agents are contained

For agents in Cerevisor's own loop

These checks apply to agents in Cerevisor's own loop: the Anthropic, OpenAI-compatible and Gemini providers.

• Every tool call such an agent makes during a workflow run passes through ten stages that can only narrow what is allowed. A stage that tries to widen it is refused, and the call is denied.
• An agent's file tools read and write only inside the workflow's folder and the files you declared for that agent. They may also read your installed skills.
• By default, a shell command that names a place outside the folder asks you first. In a run nobody is watching, that command is refused.
• Content an agent reads from the web, from email, from an MCP server outside your trusted list, from a shell command that fetches from the network, or from a file outside the workflow's folder is marked untrusted.
• An agent holding untrusted content must ask you before it sends data to a site outside the workflow's approved list. In a run nobody is watching, that send is refused.
• If that agent also holds a secret, the send is blocked for the rest of the run. That is the Rule of Two, and the app enforces it in code, independent of the prompt.

Secrets and shared files

• An agent receives a secret as an environment variable, or where a tool call names it as a placeholder, when the tool runs. Secret values stay out of an agent's instructions.
• A shared workflow package someone sent you is checked and cleaned again before anything is written. It cannot write into Cerevisor's own folders. Nothing in it runs when you open it.
• Opening a workflow file looks up a network share only when the file itself is on that share.

Harnesses that run their own loop

Claude Code, Codex, Cursor and Antigravity own their own loop, so they run outside the checks above. Cerevisor says so in the pre-run summary. It records what it handed each harness in the run's history. It checks which files changed after the harness finishes.

Grok Build is the exception: unless its sign-in is set to approve everything, Cerevisor decides each of its tool calls before it runs.

The full account is in the security reference in the docs.

Every run on the record

A plain file you can read

Every run writes a log to ~/.cerevisor/audit-logs, one file per session. It holds every event, every tool call with its arguments and result, every permission decision, every model call with its provider, model, tokens and cost, and any errors.

It is plain text, so you can open it in any editor, search it, or keep it with your own records. When you settle a question by hand during a run, your decision is written into the run's history, and changing your answer later never erases the first one.

Local models

Keep model traffic on hardware you control

Connect Ollama, vLLM or LM Studio as an OpenAI-compatible provider, and agents send their model calls only to that endpoint. Cerevisor reports those runs at $0.00, since local models have no per-token price.

The app's own three connections are separate from model traffic. You can turn off the update check and the skill-matching download, and if you never activate a paid licence, the licence check never happens.

A short hardening checklist

Settings worth a minute

• Start a new workflow in Oversight, then move to Auto once you trust what it does.
• Give each agent only the files it needs. Its file tools stay inside the workflow's folder and the files you declared.
• Save API keys and passwords in the vault, never in an agent's instructions.
• Leave MCP servers untrusted until you know them, and turn MCP tools off for workflows that do not need them.
• Set a budget cap before you schedule a workflow, and read its run log afterwards.
• On Linux, run a keyring service, so vault secrets are encrypted at rest.
• Keep the update check on, so security fixes reach you. Only the latest release receives fixes.

Reporting a vulnerability

One address, with response targets

Email [email protected]. Please keep a vulnerability private until a fix is released.

Include what you can of: a description, steps to reproduce, the version (Settings, Updates shows it), your operating system, and the impact you see.

Response targets: an acknowledgment within two working days, a first assessment within seven days, and a released fix for a confirmed issue within thirty days. Only the latest release receives fixes. Reporters can be credited in the release note on request. There is no bug bounty.