✦ Security & Privacy
Your code never leaves your machine.
Tatastu is a local-first desktop app. Your projects, chats, and credentials live on your own Mac, encrypted by the operating system. There is no Tatastu cloud holding your work, because by design there cannot be.
✦ Where your data lives
Three places data can go. Two of them never see your code.
Local runs stay on your device and use the AI provider you choose. If you start an optional hosted run, Tatastu's coordinator and isolated execution infrastructure receive the scoped workload and credentials needed to run it.
Everything, encrypted
Stored locally, protected by the macOS Keychain.
- Projects & source code
- Chat history & prompts
- API keys & credentials
The app's UI is blocked from reading these files at all.
when you send it
license status only
Anthropic, OpenAI, or local
Local runs connect from your Mac to the provider you configured, on your own account. Choose Ollama and the model runs on your machine.
Billing and optional hosted runs
Our account service checks plan status. For a hosted run, Tatastu operates the coordinator and isolated execution node and handles the scoped repository, provider credential, checkpoints, and results required for that run.
✦ Plainly stated
What stays, and what leaves.
Stays on your device
Local unless you choose hosted execution
- Your local project copy and files not selected for a hosted run
- Chats and prompts not sent to a provider or hosted run
- Provider keys for local runs; hosted credentials are separately scoped and encrypted
- Settings, history, and local databases
Uninstalling and clearing app data removes everything we placed on your machine. Your own project folders are never touched.
Leaves your device
The minimum, only when needed
- Purchase email + license status, to our billing service
- Whatever you send to your chosen AI provider
- Hosted-run workload, scoped credentials, checkpoints, and results, only when you choose a hosted run
- Crash reports, only if you opt in, and scrubbed of secrets
- Anonymous, cookieless page counts on our website
No advertising, no behavioral profiling, no selling data. We do not build a profile of you.
✦ How it is protected
The controls behind the promise.
Local-first is the architecture. These are the specific engineering controls that hold it up.
OS-backed encryption
Keys and tokens are sealed in the macOS Keychain with restrictive file permissions. The app's interface layer cannot read credential files at all.
Signed, verified updates
Every update is cryptographically signed. Your app verifies the signature before installing anything, and refuses unsigned or downgraded updates. Nothing installs silently.
Isolated interface
The UI runs walled off from system privileges, with a strict content security policy and schema validation on every internal call. AI runs in a separate sandboxed process.
Scoped file access
A single enforced gate keeps every file operation inside your open projects. Sensitive locations, including the credential store itself, are blocked by default.
Scrubbed logs & telemetry
Diagnostics and opt-in crash reports are stripped of API keys, tokens, and home-folder paths before anything is written or sent. Crash reporting is off unless you turn it on.
✦ Update integrity
An update installs only if it proves it is really ours.
Auto-update is the one channel that can change code on your machine, so it is the one we guard hardest. Verification happens on your device, and fails closed.
Fetch
Your app pulls the update manifest and files from our pinned CDN over TLS.
Verify signature
Each artifact is checked against an Ed25519 public key baked into the app you already trust.
Confirm with you
Updates never download or install on their own. You decide when to apply one.
macOS builds are additionally signed with an Apple Developer ID and notarized by Apple before they ever reach you.
✦ Who we rely on
Every company in the loop, and what it can see.
Our local-first design keeps this list short. Local runs send only what you direct to your chosen provider; optional hosted runs also use Tatastu-operated infrastructure.
| Vendor | Purpose | Sees your code? |
|---|---|---|
| AI provider you chooseAnthropic · OpenAI · OpenRouter · Ollama | Anthropic is the default. You can switch to OpenAI, OpenRouter, or a local Ollama model, always on your own account or key. A local run connects directly from your Mac. A hosted run reaches the provider through the isolated Tatastu execution node. Ollama runs locally. | Only what you send |
| Cloudflare | Hosts account services, the hosted-run coordinator and isolated execution infrastructure, update CDN, and DNS. Hosted checkpoints and results are retained for up to 30 days. | Only for hosted runs |
| Polar | Billing and license management (merchant of record) | No |
| Apple | Notarizes the macOS app so it is safe to install | No |
| Sentry | Crash reports, only if you opt in | Scrubbed only |
| Resend | Sends transactional email (receipts, activation links) | No |
| Plausible | Anonymous, cookieless website analytics | No |
✦ How we build
Security is checked on every change.
- Every code change passes automated type, lint, and test gates before it can ship.
- Secret scanning, static analysis, and dependency vulnerability scanning run continuously.
- Releases are signed, notarized, and integrity-checked before upload.
- We keep a written security policy pack mapped to SOC 2 criteria, ready for review.
Responsible disclosure
Found something? Tell us.
We welcome good-faith security research and will not pursue legal action for it. Report a vulnerability and we acknowledge it within three business days. Scope and safe-harbor terms live in SECURITY.md in our public repository.
✦ Where we stand, honestly
SOC 2-aligned, and straight with you about the rest.
We maintain a full internal security program: information security, access control, change management, incident response, vendor management, data retention, and a live risk register, with controls mapped to SOC 2 Trust Services Criteria. We have not yet completed a formal third-party SOC 2 audit, and we would rather tell you that plainly than imply otherwise. We are glad to walk your security team through any control here.