---
title: "Privacy and keys"
description: "Local store, sealed conversations, shred, and what never leaves the machine."
---

Assay is local-first. The default store is a file on your machine. Conversation text is sealed at rest. The console decrypts on the machine that already has the key.

## What stays on the machine

- The store (spans, turns, overlays, search index)
- The content key
- Dashboard reads, including decrypted timelines
- Search queries

The dashboard binds **loopback**. There is no authentication on that server. A routable bind is refused unless you pass an explicit unsafe flag. Do not do that on a shared network.

## The content key

Created by `assay init` at `~/.config/assay/transcript.key`.

<Warning>
  Back it up. Lose it and sealed text is unreadable. Metadata and labels remain. The words do not.
</Warning>

Pass `--key-file` if you keep it somewhere else. `assay turns` and the session timeline both need it.

## One road for content

Conversation text is scrubbed of common secret shapes, then sealed, then stored. It does not go in a metadata column, a sync batch, or a label note.

Search builds its index **on capture**, on this machine. It does not call a model. See [Search](/search).

## Shred

```bash
assay shred --principal <id> --yes
```

That destroys the key for **one** principal. Rows remain. Text becomes permanently unreadable. The command is irreversible. It refuses to report success on a partial erasure.

<Warning>
  **Shred does not reach a minted share.** A page you already published is a copy outside the store. Delete those shares on the Shares tab first. See [Share](/share).
</Warning>

## What may leave

| Verb | What it sends |
|---|---|
| `assay pricing watch` | Nothing from the store. Fetches **public** rate documents. |
| `assay reconcile anthropic` | Reads the Anthropic admin cost report you already have access to. Compares to the local ledger. |
| `assay share mint` | A point-in-time copy of **one** sitting you chose to publish. |
| `assay push` | Derived usage only. Conversation text is not in the payload. |

No other CLI verb reaches the network.

## The judge

A remote model scoring work sees **derived features**, not the conversation — unless you explicitly opt in to full-content judging. The default labelling path uses **your** harness AI, on your machine, through a door you turned on.

See [Labelling](/labelling).