Data Security
Encrypted at rest, encrypted in transit, custodied by the customer.
Encryption
- At rest — customer endpoint
Studio data sits on the customer's disk under whatever full-disk encryption the customer has enabled (FileVault, BitLocker, dm-crypt). PeerAI does not operate a server-side data store of customer content.
- At rest — secrets
API keys, license tokens, and credentials are stored in the OS keychain (macOS Keychain / Windows Credential Manager) by default; encrypted file fallback at ~/.peerai/credentials.json.
- In transit
TLS 1.2+ with platform-default cipher suites. LLM API calls go to provider-controlled HTTPS endpoints; database connections use the customer-supplied URI (TLS recommended and supported).
- Build provenance
SHA-256 checksums per platform, published with every release. Customer can verify binary integrity before install.
Per-release checksums
Key custody
- OS-managed
Studio does not generate or hold long-lived encryption keys. Secret custody is delegated to the OS keychain.
- Customer-rotated
API keys and credentials are rotated by the customer on the customer's cadence. Studio reads them at request time; no caching beyond the in-memory request scope.
- TLS certificates
Platform certificate store is authoritative. No custom trust roots installed by Studio.
Path safety
- Path traversal protection
core/path_safety.py enforces assert_path_within() boundaries on file-system operations — agents cannot escape user-selected directories.