Security
What we can read, and what we can't
A remote control for a coding agent sits between your source code and the network. That deserves a specific answer, not a reassuring adjective.
The model in one paragraph
Your agent — whichever one you chose — runs on your hardware, against your working tree, using your own model credentials. Nothing about that changes when you install Consortium, and Consortium never becomes a hop for your model traffic. What Consortium adds is a synchronised, encrypted view of that session so other devices you own — or teammates you have authorised — can watch it and answer its prompts. The relay moves ciphertext between them. Whether we are able to unseal it is your choice, and the next section is the honest version of that answer.
Where the boundaries are
| Data | Where it lives | Can the server read it? |
|---|---|---|
| Your source files | Your machine only | Never sent |
| Agent session content | Your devices, encrypted in transit and at rest | Depends on your custody mode — see below |
| Model API credentials | Your machine | Not transmitted for agent execution |
| Account identity and billing | Server | Yes — required to operate the account |
| App analytics (opt-in, off by default) | Third-party processors | Only if you opt in — app behaviour, never session contents |
Who holds the key
Encryption is not one setting, and we would rather show you the choice than average it into a slogan. Your account key is the root of your session encryption. There are two custody modes and they make opposite trade-offs.
| Escrow custody | End-to-end custody | |
|---|---|---|
| Who can unseal your account key | You, and Consortium | Only your devices |
| Sign in on a new device | Just sign in | Requires your 24-word recovery phrase |
| Lost your phrase | We can restore your account | Unrecoverable — by design |
| Default for accounts created after 2026-09-07 | Yes | Opt in from Settings |
| Accounts created before 2026-09-07 | Opt in from Settings | Yes — not migrated |
Why the default changed. The account key used to live only on your devices, which meant signing in somewhere new dead-ended on a recovery phrase almost nobody kept — a hard wall, not a slow path. Escrow custody trades that wall for a real concession: we hold your key sealed, so we are able to read what it protects. It is available on every plan, and switching to end-to-end custody takes one setting. Accounts that predate the change were created under the opposite promise and were deliberately left where they were.
Being precise about telemetry: analytics are opt-in and fail-closed — the setting defaults to opted-out, and tracking only starts if you answer the first-run consent prompt and choose to allow it. We would rather describe that mechanism than claim "no tracking" and be wrong. Either way it cannot include your session contents. Self-hosting removes the vendor from the picture entirely.
Why open core matters here
Encryption claims are only as good as the code behind them. The crypto library, browser protocol, and SDKs are MIT-licensed. The CLI, app, and browser core are under Business Source License 1.1, with each release converting to Apache 2.0 four years after it ships. You can read the implementation, build it yourself, and run the server on your own infrastructure.
Questions
Is source code sent to Consortium servers?
No. Agents execute on your own machine and read your files locally; Consortium is a control surface over a process you already run. This holds for every supported agent — Consortium sits below them rather than proxying their traffic. Your code executes on your own machine — Consortium is a control surface, not a hosted runtime. Session content that syncs between your devices is encrypted in transit and at rest, and you choose who holds the key. New accounts default to escrow custody: your account key is sealed to a server key and stored, so we can restore it when you sign in on a new device — which also means we are able to unseal it. Choose end-to-end custody instead and the key exists only on your devices, the relay can never read your content, and nobody can recover it for you if you lose your recovery phrase. Accounts created before 2026-09-07 are end-to-end and were not migrated. The encryption library is MIT-licensed and auditable.
What encryption does Consortium use?
Session content is encrypted in transit and at rest between your devices. Group and organisation sessions use an MLS-based protocol for multi-party key agreement. Who can unseal your account key depends on the custody mode you choose — see "Who holds the key" below. The encryption library is published under the MIT licence so the implementation can be reviewed independently rather than taken on trust.
Does Consortium collect analytics?
Analytics are opt-in and off by default. The app ships a first-run consent prompt, and product analytics stay disabled unless you explicitly answer it and do not opt out — the setting is fail-closed, so tracking never starts by default. Crash reporting and analytics cover app behaviour, never the contents of your sessions. This marketing site loads no third-party scripts and sets no tracking cookies.
How do I report a security vulnerability?
Report vulnerabilities through the SECURITY.md policy in the public repository rather than in a public issue. Coordinated disclosure is welcome and credited.