A clear data path.

What the connection stores

Open Machine Cloud stores your GitHub numeric identity and login, device public keys and names, pairing and authorization records, short-lived browser sessions, the default device, bounded version reports and connection routing state. The active connection holds only selected workspace names and a minimal GitHub configuration summary, not GitHub credentials or repository policies. Device private keys stay on the device. GitHub sign-in access tokens are used to verify identity and are not retained.

What passes through Cloud

Authorized tool requests and their results travel through Cloudflare to your device and back to your AI client. TLS ends at the gateway, so Cloud can process that content in transit. This is not end-to-end encryption. Your AI provider also receives results.

Content and diagnostics

The service does not persist workspace file contents or full tool payloads in its identity database, and application logs do not record those payloads. Operational providers may process connection metadata. The scheduled cleanup removes incomplete pairing attempts and unused or connection-purpose proofs after they have been expired for one additional day. Completed pairing receipts and proofs used for device revocation are retained with device and authorization records so the original device can recover a lost enrollment or revocation response. Revoking access preserves these records. Account deletion immediately disables account access, then removes account, device, pairing, key and authorization records through delayed, bounded cleanup. A deletion request is not a claim that cleanup has completed. Backup retention is managed by the service operator.

Your controls

You can pause or revoke a device, choose a default device, remove an AI client connection, manage browser sessions, or request irreversible account deletion from OM Account. These are separate actions. Local permissions and any already admitted Core work remain governed on your device.

This page describes the current preview implementation. Public distribution requires the operator’s final privacy and retention review.