What Cloud mode sends
In Cloud mode a change is evaluated on a hardened remote endpoint. What leaves the device is fixed, minimal and locally verifiable: a redacted, added-only diff and the file path, never the full file. This page is the exact data contract.
Overview
Cloud mode sends a projection of the change, not the file:
- Sent: the file path and a redacted, added-only unified diff, over TLS, to a fixed endpoint surface.
- Never sent: full file contents, removed-line text, directory or process listings, or system telemetry.
- Recorded: every outbound request the daemon makes is written to a local, human-readable egress ledger.
The data contract
The endpoint surface is small and fixed; each request carries a documented, minimal payload. No memory-file content crosses the boundary except as the redacted diff:
| Endpoint | When | Payload |
|---|---|---|
/enroll | once at installation | app ID and a one-time enrollment code |
/evaluate | on a protected-file change | path and redacted unified diff (no full texts) |
/getConfig | poll interval | auth token only |
/reportAudit | when new audit entries exist | timestamp, action, path, reason, scores |
/reportQuarantine | on a quarantine outcome | case ID, path, reason, scores and the redacted diff (size-capped) |
/ackDecision | once per resolved case | case ID and outcome (applied, stale or discarded) |
What each field contains
The evaluated projection is redacted, added-only and size-capped on the device before it is sent. These are the fields of the quarantine report and what each carries:
| Field | What it contains | Redacted? |
|---|---|---|
path | The path of the changed file, so a reviewer knows which file | No: path only, never content |
redactedDiff | The added lines only, with secrets and structured PII replaced by placeholders, capped in size | Yes, locally before egress |
diffFidelity | Whether the stored diff equals the judged text (exact) or is a reduced projection of it (projection) | Metadata, no content |
removedLines | The count of removed lines only; the removed text never leaves the device | Yes: only a number leaves |
originalHash | SHA-256 of the pre-change file, used for idempotency and supersede | Hash, no content |
reason, scores | A short reason string and the graded scores of the case | Metadata, no content |
Local redaction before egress
Before any byte is sent, the diff passes through a local redaction stage. Recognizable secrets and structured PII are replaced by structure-preserving placeholders, so the evaluator can still reason about the change while the sensitive values stay on the device. Key names survive; only the values are removed:
| Class | Example matched | Placeholder |
|---|---|---|
| API keys | provider-style keys, GitHub, Slack, AWS, Google, Stripe, webhook secrets | [REDACTED:apikey] |
| JWT | three base64url segments | [REDACTED:jwt] |
| Generic assignments | key/token/secret/password = value (key name kept, value removed) | [REDACTED:secret] |
| RFC-style addresses | [REDACTED:email] | |
| IBAN | country code, check digits and BBAN | [REDACTED:iban] |
| Card number | grouped card numbers | [REDACTED:card] |
| IP address | dotted-quad IPv4 address | [REDACTED:ip] |
| Phone | international format only | [REDACTED:phone] |
The egress ledger
Every outbound request is recorded locally in a human-readable ledger. Each line carries the timestamp, the endpoint, the payload size, the SHA-256 of the payload (never its content) and the HTTP status. This is the verifiable "does it phone home?" accounting:
2026-06-04T12:00:01Z endpoint=/getConfig bytes=2 sha256=44136f… status=200 2026-06-04T12:03:17Z endpoint=/evaluate bytes=412 sha256=9f86d0… status=200
Read next
How an uncertain change is held and brought to you: the user confirmation prompts. The whole protection is fail-closed.
Evaluation in the cloud, your content on the device.
A redacted, added-only diff is all that leaves the machine, and the local ledger proves it. Free for Linux, macOS and Windows.
Sign me up