Security

Clear boundaries for local data, connected services, software updates, and vulnerability reports.

Local by default

Workspace files, terminal output, and source code are not collected by Athas telemetry.

Telemetry is opt-in

Anonymous usage telemetry starts off. You decide whether to enable it in the app.

Secrets stay in secure storage

Saved provider keys and credentials use operating-system secure storage when available.

Open to inspection

Athas is open source, so its desktop code and release process can be reviewed directly.

Know where your data goes.

Athas keeps editor work local until a feature needs a service you selected. These are the defaults and the moments when data can leave your device.

Workspace and source code

Default handling

Kept on your device and excluded from Athas telemetry.

When it leaves your device

When you choose a remote workflow, such as sending context to an AI provider.

AI prompts and selected context

Default handling

Processed only when you invoke an AI feature.

When it leaves your device

Sent to the provider or endpoint you selected. Local endpoints keep the request local.

API keys and connection secrets

Default handling

Stored locally with operating-system secure storage when available.

When it leaves your device

Used to authenticate directly with the service you configured.

Usage telemetry

Default handling

Off by default.

When it leaves your device

Only after you opt in; update checks still send limited operational metadata.

Account and billing data

Default handling

Limited to operating account, support, and paid-service features.

When it leaves your device

Shared with the service providers needed to deliver those features.

Release integrity

Desktop releases pass through reproducible checks and platform-specific safeguards before they reach an update channel.

Inspect releases

Checksums for release artifacts

The release pipeline produces a SHA-256 checksum manifest so downloaded artifacts can be verified.

Signed desktop updates

Athas validates updater signatures before applying an update delivered through its release channels.

Platform signing checks

Release preflight validates platform signing and notarization credentials when those channels are configured.

Hardened web delivery

The website uses HTTPS with HSTS, framing protection, content-type protection, and a restrictive permissions policy.

Report a vulnerability privately.

Use GitHub private vulnerability reporting for security-sensitive details. Include the affected version and platform, reproduction steps, expected impact, and any useful logs or proof of concept. If GitHub is unavailable, email [email protected].

Policies and proof