Loading...
Loading...
Vreko runs as a local daemon. Your code does not leave your machine. Behavioral signals do - file paths, change sizes, timing, AI tool attribution - and those are what we use to build intelligence. This page documents exactly what we collect, where it goes, and what we do not collect.
The daemon runs locally.
vrekod is a process that runs on your machine and watches file system events. It never reads file content and never opens a network connection to transmit source code. The local IPC socket is the only communication channel between vrekod and your IDE extension or CLI. The daemon's working set is the shape of changes: which files moved, when, in what order, and which AI tools were active during those changes. Code content stays on disk where it already lives.
Only behavioral metadata syncs.
Behavioral signals sync to the Vreko API for cross-session intelligence and account-level analytics. The synced data is: file paths (relative to workspace root), change sizes in bytes, timestamps, session IDs, the agent that was active during a change, and computed hashes of diffs (SHA-256, deterministic, one-way). What does not sync: the diffs themselves, the file contents, your environment variables, or any data your agents produced. If a field is not on the published list, it does not leave your machine.
workspace.json is yours.
The behavioral intelligence Vreko produces lives in .agents/agents.workspace.json in your repo. You decide whether to commit it - recommended, so your team's agents read it - or .gitignore it. The file is plain JSON. You can read it, audit it, modify it, delete it. If you uninstall Vreko, the file stays. workspace.json is not Vreko-controlled storage; it's a standard artifact your codebase owns.
| Data | Retention |
|---|---|
| Local snapshots | Indefinite (your disk, your decision) |
| Synced behavioral signals | 90 days rolling on Vreko servers |
| Account metadata | Until account deletion + 30 days |
| Aggregated analytics | Anonymized after 90 days, retained indefinitely |
| Audit logs | 1 year |
Account deletion is self-serve at console.vreko.dev/settings/delete-account. All synced data is purged within 30 days of request.
Vreko is in active SOC 2 Type I observation. Type II report expected in 2027. Detailed compliance documentation will be available via our trust center at trust.vreko.dev when these are issued.
Found a security issue? We run a coordinated disclosure process and credit researchers on request. Report vulnerabilities to [email protected].