Technical boundary / operator-owned configuration
Security and privacy boundaries
Trace what stays on the local host, which configured paths can send data elsewhere, how tool authority is bounded, and where vulnerability details belong.
Local host
What runs locally
The standalone host, agent loop, tools, durable events, memory, scheduler, approvals, and local interfaces run on the operator's machine. Model-backed work still needs a configured local or remote model connection.
Durable local state
- Default
- Run journals, memory, schedules, parked approvals, and chat records use local state stores.
- Operator choice
- The operator chooses the state location, host account, backup policy, and enabled storage backends.
- Retained limit
- Local does not mean inaccessible to the host account, administrators, backups, malware, or every process on the device.
Model connection
- Default
- No silent fallback provider is selected. Model-backed work waits for a configured local or remote connection.
- Operator choice
- The operator chooses the provider/endpoint, credentials, model, and content sent for model-backed work.
- Retained limit
- A remote provider receives the prompts, context, and responses sent to it and applies its own terms, retention, and availability.
Connectors, channels, and remote APIs
- Default
- Optional network integrations are not needed for the standalone local host.
- Operator choice
- An operator or administrator explicitly enables and authenticates each connector, channel, webhook, peer, or remote API surface.
- Retained limit
- External systems receive the data the enabled integration sends; scope, transport, and third-party behavior remain material.
Local web listener
- Default
- The product web interface binds to loopback by default.
- Operator choice
- Non-loopback use requires explicit exposure, authentication, and operator-managed network protection/TLS.
- Retained limit
- The product listener speaks plain HTTP; it must not be exposed directly to the open internet.
Configured edges
When data leaves the device
Remote traffic follows explicit model, connector, channel, webhook, peer, API, or optional Platform configuration. “Local-first” does not mean that configured remote services never receive data.
| From | To | Data | When | Configured by |
|---|---|---|---|---|
| User and device | Local Holaryn host | Instructions, selected files/content, configuration, and approval decisions | When the user operates a local product surface | User or local operator |
| Local Holaryn host | Local durable state | Run events, memory, schedules, parked approvals, transcripts, settings, secrets, and selected artifacts | For enabled features that persist state | Application defaults plus local operator configuration |
| Local Holaryn host | Configured model provider | Prompts, selected context, tool summaries, and model responses | Only for model-backed work after a provider/endpoint is configured | User or administrator |
| Local Holaryn host | Optional connector or channel | Integration-scoped messages, files, events, credentials, and API payloads | Only after that connector, channel, webhook, peer, or remote API is enabled | User or administrator |
| Local Holaryn host | Optional Synergentic Platform | Configured HACP control/event data | Only when connected mode is explicitly configured | Administrator |
Authority before action
Tool authority and approvals
Policy and approvals are an authority boundary, not an assurance that an instruction, tool, provider, extension, or external result is safe or correct.
Consequence-aware policy
Tools carry consequence/category metadata and the selected autonomy posture resolves whether work proceeds, notifies, asks, or refuses.
Operator action: Review the exact plan, target, and consequence before allowing a consequential action.
Retained risk: Approval records authority for that action; it does not make the action correct, reversible, or risk-free.
Unattended work parks
A schedule, teammate, peer, or delegated child cannot silently approve a gated action on the operator's behalf.
Operator action: Review parked work in the approvals surface before it can continue.
Retained risk: An unanswered approval can pause completion indefinitely and external state may change while work waits.
Untrusted input stays untrusted
Connector, MCP, and tool-result provenance is retained so untrusted content cannot silently drive consequential work.
Operator action: Start a clean operator-directed turn when suspected prompt injection blocks a consequential transition.
Retained risk: No guardrail eliminates prompt-injection, extension, credential, or operator-judgment risk.
Credentials and exposure
Secrets and network exposure
Provider credentials use write-only storage or environment-backed configuration and are not read back into the browser. Host permissions, process access, backups, enabled integrations, and network topology still determine the effective boundary.
Write-only UI: secret values are accepted for storage but not returned to browser settings views.
Protected state: the host applies operating-system permissions; administrators and the host account still remain trusted.
Loopback default: the web interface binds locally unless an operator explicitly exposes it.
Non-loopback responsibility: authentication, trusted ingress, TLS, DNS, firewalling, rotation, and monitoring belong to the operator.
Opt-in beta
Optional encrypted state
Classified local state and recovery backups can use authenticated encryption when the feature and keys are explicitly configured.
Authenticated envelope encryption
Operator action: Plan key custody and recovery before enabling it; wrong or missing keys fail closed.
Coverage limit: This beta does not cover every store, process, operating-system artifact, or residual metadata and remains pending independent review.
Exact release evidence
Release integrity and updates
Checksums, signatures, software bills of materials, provenance, manifests, and platform evidence apply only where they are published and validated for the selected release. There is no universal “signed everywhere” badge.
Exact release evidence unavailable
The website has no complete current Nightly snapshot to qualify integrity guidance. It does not substitute Stable, another release, or a moving branch.
Inspect published release recordsOperator-run topology
Deployment boundaries
A hardened Docker Compose reference supports a loopback-minimal profile and an optional validated public-TLS profile on one Linux host.
Single-host Compose reference
Operator responsibility: The operator owns host hardening, TLS, ingress, identities, secrets, monitoring, backups, restore tests, and updates.
Topology limit: It is not a high-availability cluster, managed service, managed tunnel, or serverless deployment.
The optional Synergentic Platform is a separate system that can attach through HACP. It is not bundled with or required by the standalone Agent.
Shared responsibility
Known limits and operator responsibilities
Security depends on the exact release, configuration, host, providers, integrations, extensions, network, and operator decisions. The following boundaries remain open or environment-owned.
- Remote providers and enabled services receive the content sent to them and apply their own terms, retention, access, and availability.
- Local state, secrets, encryption, redaction, approvals, and provenance reduce specific risks but do not eliminate host compromise, malicious extensions, prompt injection, or operator error.
- Encrypted state is opt-in beta coverage, not full-disk encryption or complete erasure; independent security review remains Pending.
- Release signing and evidence vary by release, platform, package, and updater target.
- The Compose reference is one-host self-hosting, not high availability or a managed service.
- Optional Platform attachment does not establish public availability, pricing, managed features, or a support commitment.
Keep findings private
Report a vulnerability privately
Send security findings privately before public disclosure. Do not place vulnerability details, secrets, exploit steps, or affected private data in a public issue or general feedback report.
Private security address
security@synergentic.techNo response time, PGP key, bounty, safe-harbor term, or disclosure timeline is promised.