Security
Local by default
Workspace files, terminal output, and source code are not collected by Athas telemetry.
Telemetry is opt-in
Anonymous usage telemetry starts off. You decide whether to enable it in the app.
Secrets stay in secure storage
Saved provider keys and credentials use operating-system secure storage when available.
Open to inspection
Athas is open source, so its desktop code and release process can be reviewed directly.
Know where your data goes.
Athas keeps editor work local until a feature needs a service you selected. These are the defaults and the moments when data can leave your device.
Workspace and source code
Default handling
Kept on your device and excluded from Athas telemetry.
When it leaves your device
When you choose a remote workflow, such as sending context to an AI provider.
AI prompts and selected context
Default handling
Processed only when you invoke an AI feature.
When it leaves your device
Sent to the provider or endpoint you selected. Local endpoints keep the request local.
API keys and connection secrets
Default handling
Stored locally with operating-system secure storage when available.
When it leaves your device
Used to authenticate directly with the service you configured.
Usage telemetry
Default handling
Off by default.
When it leaves your device
Only after you opt in; update checks still send limited operational metadata.
Account and billing data
Default handling
Limited to operating account, support, and paid-service features.
When it leaves your device
Shared with the service providers needed to deliver those features.
Release integrity
Desktop releases pass through reproducible checks and platform-specific safeguards before they reach an update channel.
Inspect releasesChecksums for release artifacts
The release pipeline produces a SHA-256 checksum manifest so downloaded artifacts can be verified.
Signed desktop updates
Athas validates updater signatures before applying an update delivered through its release channels.
Platform signing checks
Release preflight validates platform signing and notarization credentials when those channels are configured.
Hardened web delivery
The website uses HTTPS with HSTS, framing protection, content-type protection, and a restrictive permissions policy.
Report a vulnerability privately.
Use GitHub private vulnerability reporting for security-sensitive details. Include the affected version and platform, reproduction steps, expected impact, and any useful logs or proof of concept. If GitHub is unavailable, email [email protected].