Security and privacy
PP Agent is local-first. There is no PP Agent account and no PP Techs service that receives your conversations. The boundaries below are the ones that matter in practice.
Keys and the vault
Section titled “Keys and the vault”API keys for model providers, search services, and the Telegram and Zalo bots are encrypted with a master key.
- The master key is kept in your operating system’s keychain.
- With the daemon on a server or in Docker, set
PP_AGENT_MASTER_KEY(32 bytes, hex or base64) so the key does not depend on a desktop keychain. - Conversations and workspace files do not contain plaintext keys.
What leaves your computer
Section titled “What leaves your computer”Only what a request needs:
| Destination | What is sent |
|---|---|
| Model provider/gateway | The conversation context needed for the answer |
| Search service | Your search queries |
| MCP server | The tool call and its arguments |
| Speech-to-text service | Audio, if you chose a service instead of local whisper |
| Telegram or Zalo | Messages and approvals in the paired chat |
Pages on private networks are never opened by the agent’s web tools. The browser in the side panel can reach what you navigate to, under your control.
Approvals
Section titled “Approvals”Read-only actions run freely. Saving files, shell commands, and actions that change data in your systems ask first by default. Each tool can be automatic, ask, allow, or off; see Tools and approvals.
Computer use adds its own rules: looking is free, clicking and typing ask first, and PP Agent itself, terminals, and password settings are always off limits.
Remote access
Section titled “Remote access”Remote access over the local network is not encrypted and is off by default. Use it on networks you trust. Settings that let the agent run programs without asking stay on the computer.
Known limits
Section titled “Known limits”- No cloud sync. Conversations and files live on the computer that runs the daemon.
- Provider handling is outside PP Agent’s control. Your model provider’s terms govern what it does with a request.
- MCP servers run with your user permissions. Review a server before adding it.
- Approvals depend on the person. An always-allow policy is exactly as broad as it sounds.
- Exported files are not protected. A Markdown or HTML export is a normal file; store it accordingly.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Report security issues privately as described in SECURITY.md. Do not open a public issue for a vulnerability.
Related: Data storage, Architecture.