Your work never
leaves your Mac.

01What runs where

In short: Everything runs on your Mac. Nothing about your work passes through us.

The agents in AI Bridge are the real command-line tools — Claude Code, Codex, Grok and OpenCode — running in real terminals on your Mac and signed in with your own accounts. They talk to Anthropic, OpenAI and the others directly, exactly as they do in any terminal. AI Bridge does not proxy, read or relay that traffic.

The same goes for everything you connect. Clusters are reached through your own kubectl and kubeconfig, databases through psql and mongosh, remote machines through your system’s ssh, and Slack with your own Slack sign-in. Every one of those connections goes from your Mac straight to the service.

To show you each agent’s state, the sessions AI Bridge starts report to it over a connection that never leaves your Mac. Your workspaces, instructions, automations and history are plain files under ~/Bridge and in the app’s own folder. There is no database of ours behind them.

02What we hold

In short: Nothing, if you never sign in. If you do: your account, your Macs and your plan. Never your work.

Without an account, AI Bridge never contacts us. Signing in, which a trial or a paid plan needs, creates an account, and for it we hold:

• your email address, your name and the sign-in you used (GitHub, Google, Microsoft or GitLab);
• each Mac you sign in on: a one-way hash that identifies it (not its serial number), its name, the app’s version and when it last checked in;
• your trial, your plan and its payment records. Stripe handles the payment itself, and we never see your card;
• your team and its invitations, if you are on Team;
• your email preferences, and any “I want this” you pressed on a feature that is coming.

We never receive your code, files, prompts, conversations, terminal output, anything from your clusters or databases, or any credential. The privacy policy says how long we keep each item and how to have it deleted.

03What the app sends on its own

In short: An update check, and a plan check about once a day once you sign in. No telemetry.

AI Bridge has no telemetry, no analytics and no crash reporter. If it crashes, the details go to a log on your Mac and nowhere else. On its own, it makes two requests:

• Update check. At launch and every few hours, it asks GitHub, where our releases are published, whether a newer version exists. It downloads one only when you choose Download.
• Plan check. Once you are signed in, about once a day, it sends us this Mac’s hashed identifier and the app’s version, and receives your plan’s signed licence.

Two more happen only after you turn them on, and neither comes to us:

• Usage limits ask Anthropic every few minutes how much of your Claude plan is left, using Claude Code’s own sign-in.
• A connected Slack workspace is checked for new messages every 30 seconds, from your Mac to Slack.

Everything else — opening a cluster, querying a database, connecting to a host, installing a tool in Setup, sending feedback — happens when you do it.

04Credentials and copies on your Mac

In short: Kept on your Mac, encrypted with a key in your macOS Keychain, readable only by you.

What you give AI Bridge — your Slack sign-in, database connection strings, this Mac’s sign-in to your account — is kept in the app’s own folder, encrypted with a key that macOS holds in your Keychain, in files only your user account can read. If macOS ever denies AI Bridge that key, the files stay readable only by your user account, but are not encrypted.

• Clusters. AI Bridge holds no cluster credentials of its own. It works through kubectl and your kubeconfig, which it only reads, except to remove a context you ask it to remove, after backing the file up.
• SSH. It reads your SSH config and uses your system’s ssh. Your keys stay where they are.
• AI providers. Each CLI keeps its own sign-in. AI Bridge reads Claude Code’s only to show your usage limits, and only once you turn them on.

Some of what AI Bridge keeps on your Mac is sensitive in itself: terminal history, and the copy of an object it saves before a destructive change to a cluster, which for a Kubernetes Secret includes its values. All of it stays in folders only your user account can read, and stays until you free it. Turn on FileVault, as you would for any Mac that reaches production.

05Guardrails on what agents do

In short: Changes to clusters, databases and Slack are shown to you first and recorded.

• Clusters. Every change goes through a card that names the cluster and shows what will happen before anything runs. Before anything destructive, AI Bridge saves the object as it stood, so you have what you need to put it back.
• Databases. Anything that would change data is shown to you first, with the exact statement that will run.
• Slack. A reply waits for you to send, edit or decline it before it posts under your name, unless you choose to trust that channel.
• Assist. The built-in assistant shows each change it wants to make on a card before it happens. If you allow a kind of action for good, it still tells you each time and records it.
• Custom views. The code that draws a view has no network access. Its data comes from reads AI Bridge runs for it, and its buttons ask before they run unless you tell them not to.
• A record you can check. Cluster writes, database writes, Assist’s actions and Slack posts each go into a hash-chained log on your Mac, so an edit or a gap shows up when you verify it. You can export it too.

Which shell commands and file edits an agent may make is up to the CLI’s own permission mode, exactly as in your terminal. AI Bridge does not loosen it.

06The app itself

In short: Signed by us, notarised by Apple, with Electron locked down.

• Every build is signed with CyberNucleus Pty Ltd’s Apple Developer ID, notarised by Apple and runs with the hardened runtime, so macOS checks it before it opens.
• Electron’s riskier switches are fused off: the app cannot be run as plain Node.js, loads only its own packaged code and checks that code’s integrity, and ignores NODE_OPTIONS and debugging flags.
• Its interface runs sandboxed and cannot navigate away from the app. Links in terminal output open only when you ⌘-click them.
• Updates come from our GitHub releases and are installed only when you choose to.

07SOC 2 and security reviews

In short: No SOC 2 report: there is no store of your work for one to audit. We answer security questionnaires.

SOC 2 is an audit of how a company protects the customer data it stores and processes in its own systems. AI Bridge stores and processes your work on your Mac, not in ours: the one service we run holds the account and plan records listed above. So we have no SOC 2 report, and the controls that matter for AI Bridge are the ones on the Mac your company already manages: disk encryption, who can log in, and which accounts your agents and kubeconfig use.

If your company needs a security questionnaire answered, or more detail than this page gives, email security@aibridge.sh.

08Reporting a problem

In short: security@aibridge.sh, or a private security advisory on GitHub.

If you think you have found a security problem in AI Bridge, the app or this site, email security@aibridge.sh or open a private security advisory on our GitHub repository. Please do not open a public issue for it. Our security.txt says the same.