MeshBoard — Security & privacy

The three places your data can be

Everything MeshBoard touches lives in exactly one of these zones. Nothing moves zones silently.

The room — your network

Where everything lives by default

Your code and files — on your disks, full stop.
Local model runs — the model executes on your hardware; prompts and outputs never leave it.
Live streams — watching an agent work is LAN traffic between your devices.
Job history and receipts — stored on your machines, not our servers.

The bridge — our relay

So your phone works from anywhere

Sign-in — your email, for the magic link. That's the account.
Push nudges — "the mesh needs a decision" travels encrypted; the relay can wake your phone, not read your work.
Away-from-home control — approvals and asks pass through end-to-end encrypted between your phone and your mesh.

Never on the relay: your code, your files, your streams, your receipts.

The exception — cloud models

Only when you choose, only the slice

You opt in per mesh, per request, or never — "local-only" is a real setting, not a preference.
Only the slice the job needs goes to the model — not your repo, not your history.
Labeled before, receipted after — the job says "via cloud model" up front; the receipt shows exactly what went and what it cost.

Every exception leaves a receipt

The contract — identify itself, ask for permission, leave evidence — applies to us too. When anything crosses a zone, the receipt says so in plain words:

via cloud model"Rewrote 3 email templates with a frontier model — sent: the templates and your tone notes. Sent nothing else. $0.84."

left the room"Deployed to your host — sent: the built site. Your source stayed home."

lent out"Omar's mesh borrowed the Mac mini for a writing job — its files stayed in his mesh; yours were never visible to it."

Your controls

Local-only, anywhere you want it

Per mesh, per machine, or per request. A local-only job cannot use a cloud model — it fails honestly instead of quietly upgrading.

Watching is a grant

Live streams and replays are visible to you by default and to nobody else — other people see them only if you grant it, and you can take it back.

Linking is reversible

Sharing with another mesh is an explicit, asymmetric grant — verified with a fingerprint you can see. Unlink takes effect immediately.

Leave whole

Everything important lives on your machines, so leaving MeshBoard means turning it off — your code, history, and receipts are already yours.

Your source never leaves the room unless you say so.