Security & data handling
Your code is yours. We built around that.
Corvi is local-first: your data stays on your Mac unless you opt into cloud sync. Below is exactly where your data lives, how it's protected, and what we can and can't see — written plainly, no hand-waving.
Local-only
The default
By default your plans and workspace data never leave your Mac unless you explicitly send a request to a model provider with your own key. There's no Corvi account and no Corvi server in the loop.
Optional cloud sync
End-to-end encrypted (zero-knowledge)
If you sign in to sync across your own devices, everything is encrypted on your device before it leaves. Keys are derived on your devices; Corvi's servers store only ciphertext and cannot read your plans. We sync to move your data between your devices — not to see it.
How we protect your data
Encryption at rest & in transit
All network traffic uses TLS. Synced data is end-to-end encrypted before it leaves your device; local credentials are encrypted at rest on your Mac.
An egress audit — "what left this machine"
Every outbound tool call is opt-in per integration, capped by a fetch budget, and recorded with its arguments hashed. You can see precisely what data left your machine and why.
A security broker as a trust boundary
The engine reads your repository only through a broker that scopes what it can see to the workspace you choose. Untrusted content is wrapped before it reaches a model.
Bring your own model keys
Provider keys are yours. Corvi resolves them from your environment or encrypted local storage — never from a shared Corvi-held credential.
Subprocessors
Local-only usage involves no Corvi subprocessors at all — this list applies only when you opt into cloud sync.
| Subprocessor | Purpose | Region |
|---|---|---|
| Model providers (Anthropic, OpenAI, OpenRouter — your keys) | AI inference (only when you invoke a run, with your key) | US / EU |
| Scaleway | Hosting — API and the blind sync store (E2E ciphertext only) | EU (Paris) |
| Resend | Transactional email (email verification, magic links) | EU sending region |
Compliance & certifications
We'd rather be honest than aspirational: Corvi does not hold SOC 2 or ISO 27001. The strongest guarantee is structural — by default nothing leaves your Mac, and the optional sync store is blind (end-to-end encrypted ciphertext only, which we cannot read).