The short version: your work stays on machines you own, and the only things that cross the internet are the model calls you chose to make.

What never leaves your Mac

• Your API keys. Keychain, never uploaded, never synced to the phone, never sent to a relay.
• Your files and workspaces. They live in the session folder on your Mac.
• Document parsing. Extraction runs as a plain program in a local box, with no model call.
• Memory. Markdown files on your Mac.
• The audit log. Local.

What crosses the network

Model calls. When an agent thinks, it calls the provider whose key you supplied, directly. That is a normal API call from your machine to Anthropic, OpenAI, Google or whoever you chose. Whatever the agent puts in the prompt goes with it, under that provider’s terms.

This is the honest boundary. Operator does not send your data anywhere, but an agent you asked to read a document and answer a question will put the relevant part of that document in a prompt. If that matters for a particular document, run the job with a local model and nothing leaves at all.

Phone to Mac messages. Encrypted end to end. A relay passes the bytes between your devices and cannot read any of them. It sees that two paired devices are talking, not what they said.

Catalog fetches. Your apps download the public catalog of Solutions and skills. That is a read of a public file and carries nothing about you.

What Operator the company can see

Nothing about your work. There is no Operator model proxy, no Operator API key, and no server that holds your sessions. If you subscribe, Stripe knows you pay us, which is the extent of it.

The audit log

Every event and every approval decision is recorded locally in a tamper evident log: entries are chained, so a changed entry breaks the chain and is detectable.

It is there so you can answer “what did it do, and who said yes”, weeks later, with evidence rather than recollection.

Turning the network off entirely

Some jobs run with no network at all. For work on sensitive data with a local model, the whole run happens on your Mac with nothing reachable outside it.

Deleting things

• A session: deletes its workspace and history.
• A memory fact: goes immediately.
• A key: removed from the Keychain. Jobs already running keep the copy they were handed.
• Everything: delete the app’s data folder. There is no server-side copy to chase.