Security

Your code never leaves your Mac. Here is exactly what does.

Agents run on your Mac, on your own Claude Code login. Dark Matter keeps track of the work and walls your org off from every other. Each claim on this page says whether it is shipped, in the release candidate, or planned.

ShippedRelease candidatePlanned

Where your data goes

Three places, and one rule: content stays on your Mac.

Your Mac keeps what an agent said and did. Our servers keep the index: what happened, when, and what it cost.

Your MacStays here

Agent transcripts, tool input and tool output
Terminal recordings of every agent session
Your clones, and each agent’s branch checkout
Chat, notes and your chief of staff’s thread
Your Claude Code, Codex, git and gh logins
Keychain: your sign-in token and the assistant’s API key

The step index onlyThe table refuses any other field

Our serversPostgres

Orgs, people and memberships
Projects, tasks, plans and their links
Decisions, reviews and findings
Activity: one signed line per event
Run steps: kind, time, tool, path, commit and cost

Only what each needsListed under subprocessors

RentedSubprocessors

Auth0: sign-in
GitHub: your repositories, through your own login
Sentry: scrubbed error reports
PostHog: a fixed list of usage events
Vercel: this website

The cloud never calls your Mac. Your Mac reads from our servers and writes the index to them; agents push to GitHub as you, never as Dark Matter.

What we hold about you

Eight kinds of data, and where each one lives.

Read from the schema and the contracts, not from a policy written beside them.

Data	Where	What it contains	Status
Agent transcripts and tool output	Your Mac only	Never uploaded. The run-steps contract has no field for content, and the table refuses any key outside the index.	Shipped
The run index	Our servers	Step kind, time, tool name, file paths, commit SHAs, cost and model.	Shipped
Your code	Your Mac only	Your clones and each agent’s branch checkout beside them.	Shipped
Your work and plans	Our servers	Task titles, plan blocks, findings, decisions and pull request bodies. These are written about the work, so they can quote a line of code.	Shipped
Chat, notes and chief of staff	Your Mac only	Chat threads, your notes vault, and the chief of staff’s thread and rules.	Shipped
Who you are	Our servers and Auth0	Email, name, GitHub login and org memberships. Auth0 holds passwords and sign-in tokens. Credentials Dark Matter issues are stored hashed.	Shipped
Model API keys	Your Mac, or sealed on our servers	The assistant’s key stays in the macOS keychain. A key you store with Dark Matter is sealed with AES-256-GCM under a key derived for your org and that provider alone.	Shipped
Errors and usage events	Sentry and PostHog	Scrubbed errors and a fixed list of events, sent only where a deployment is configured to. This website loads no analytics script.	Shipped

Tenancy

Two walls between your org and every other.

The tenant is the org. Every row of org data carries its org id, and a request can only reach the org its credential names.

Your credentialA sign-in token, a delegate credential or a Mac’s credential. Each names one org.

The org it namesThe API reads the org from the credential, never from the request body.

Wall 1 · every queryEvery read and write filters by that org id. All org data carries one.Shipped

Wall 2 · the databasePostgres row-level security on every org table. The API connects as a role that does not own them, so a query that forgets wall 1 returns nothing.Release candidate

The cross-tenant probeRelease candidate

A suite that calls every documented route as one org, using a second org’s ids. It passes only if no route returns or writes the second org’s data. It runs with both walls up, then with wall 2 off, so each wall is proven on its own.

176 routes probed · 0 leaks · 2026-10-24 · commit c883e3b

Credentials

Every credential has one holder.

Four places hold secrets, and none holds another’s.

Your Mac
- Your sign-in refresh token, in the macOS keychain
- The assistant’s API key, in the keychain
- Your GitHub, Claude Code and Codex logins, used as you
The app bundle holds no secret. Its update feed is a public address.
The API
- The database address
- Auth0’s settings for checking tokens
- The root key that seals model API keys
- Error and analytics project keys
Release candidate: these move into Secret Manager, and the root key into Cloud KMS.
The build system
- Apple signing and notarization keys
- No cloud key: deploys sign in through Workload Identity Federation
Release candidate: the deploy line to Google Cloud.
This website
- The web sign-in client and its cookie secret
- Error and analytics project keys
It calls the API as you, never with a service key.

Subprocessors

Six services, and what each one sees.

Model spend is never ours: agents run on your own subscription, so no model provider is on this list.

Service	What for	What it sees	Status
Google Cloud	Hosts the API, the database and the release downloads, in us-west1	The rows on our servers, as listed above	Release candidate
Vercel	Hosts this website	Requests to this site and your web session cookie	Shipped
Auth0	Sign-in	Your email, name and how you sign in	Shipped
Sentry	Error reports	Scrubbed stack traces, tagged with an install id or your user id	Shipped
PostHog	Usage events	A fixed list of events. Every property is an id, a count or a set value, never free text	Shipped
GitHub	Your repositories and pull requests	Agents push with your own login. Dark Matter reads pull request events for your org	Shipped

Shipped and planned

What is built, what is next, and what is not started.

Shipped means it is on main and in the app you download. A row moves up this table only after its code ships.

Commitment	Status	Detail
Org filter on every query	Shipped	Wall 1. The org comes from the credential.
Content stays on your Mac	Shipped	Only the step index reaches our servers, and the table refuses anything else.
Model API keys sealed per org	Shipped	AES-256-GCM, with a key derived for each org and provider.
Postgres row-level security	Release candidate	Wall 2, on every org table, with the API on a role that does not own them.
Cross-tenant probe in CI	Release candidate	Every documented route, as one org against another.
Root key in Cloud KMS	Release candidate	The key that seals model API keys leaves the API’s environment.
Retention windows	Planned	No retention window is defined yet.
Export your org’s data	Planned	Not built yet.
SOC 2	Planned	No audit has started.

Check it in the source. Every claim here is in the code.

Contracts · migrations · the registry

Read the source on GitHub Download for macOS