Data and security

Understand how Clawdi handles common data flows, credentials, Vault values, and support diagnostics.

Use this page to understand where Clawdi runs, how credentials and Vault values move through common workflows, and what to review before sharing diagnostics. For governing terms, read the Privacy Policy and Terms of Use.

Data location follows the run path

For a Connected Agent, Agent software and its primary runtime remain on your computer. The CLI can upload Session and Skill data available to its sync commands, retrieve shared resources, and keep local integration state under ~/.clawdi by default.

For a Cloud Agent, the Agent runtime and the files managed through that runtime are remote. Connected Agent and Cloud Agent describe where the Agent runs; they do not change the meaning of shared Clawdi objects or make shared capabilities exclusive to one run path.

Use dry-run modes before sync or secret-handling commands change anything:

clawdi push --dry-run
clawdi pull --dry-run
clawdi run --dry-run --env-file .env.clawdi -- npm run dev

Authentication data on your computer

The CLI stores its normal login at ~/.clawdi/auth.json and local configuration at ~/.clawdi/config.json. clawdi auth status identifies the credential source without printing the token, but its output can include account identifiers and local paths.

Protect the complete ~/.clawdi directory, do not commit it, and never share auth.json, pending callback URLs, environment files, or daemon token files.

Vault boundaries

Vault values are stored server-side and resolved only for supported, authorized operations. Clawdi can decrypt stored Vault values and credential profiles; a Vault is not a zero-knowledge secret store.

Prefer references and standard input over plaintext command-line flags:

printf '%s\n' "$OPENAI_API_KEY" | clawdi vault set OPENAI_API_KEY --stdin
clawdi run --env-file .env.clawdi -- npm run dev

clawdi read, a non-dry-run clawdi run, and other resolving commands can place plaintext in a terminal or child process. Review command help and the destination process before resolving a value.

Project sharing can authorize a recipient’s supported CLI or Agent runtime to use shared Vault values even though the dashboard does not display plaintext. Read Permissions and sharing before sharing a Project with an attached Vault.

AI Providers and third parties

For Connected Agents, the local AI Provider catalog stores metadata and credential references rather than API key values. Model requests continue from the Agent runtime to the selected provider. Connectors and Channels can send data to the external app or messaging service when an authorized Agent uses them.

Review the terms and data practices of every model provider, Connector, and Channel you enable. Clawdi’s permission to use a resource does not replace the external provider’s controls.

Diagnostics can contain private data

Logs and JSON diagnostics can include emails, IDs, Project names, file paths, endpoint URLs, Session content, or tool output. Before sharing diagnostics:

• Remove tokens, API keys, cookies, callback URLs, and Vault values.
• Remove .env contents and complete clawdi:// references when their names or identifiers are sensitive.
• Replace account, Agent, Project, Channel, and Session identifiers with placeholders.
• Review every line rather than assuming --json output is anonymous.

See Clawdi support for a safe collection checklist.

Policies and additional requirements

Retention, deletion, backups, data residency, encryption guarantees, compliance, security assessments, incident response, and service levels are outside the scope of this product guide. Review the Privacy Policy and Terms of Use, and contact Clawdi support about requirements that affect your use of the product.