Skip to main content
Security & trust

Private by construction.
Verifiable, not just promised.

Most vendors ask you to trust a privacy policy. OpenEng makes privacy a property of the architecture. Your open-weight models run on your machine, and your prompts, code, memory, and keys are never readable off it — not because we promise it, but because the wire has no field to carry them and the channel is encrypted end-to-end past a blind broker.

Read the security docs Open the Web Console
Blind relay No telemetry No inbound port End-to-end encrypted

The egress invariant

The wire has no field to leak.

Privacy here is a property of how the channel is shaped, not a runtime check you have to trust. The channel between the browser and your engine carries exactly two things — and nothing else has anywhere to travel.

No field for a secret

The channel carries only your request and the rendered tokens that come back. There is no field for prompts, persona, memory, embeddings, secrets, or keys — so there is nothing to leave, accidentally or otherwise.

The models stay on your machine

Your open-weight models run locally, isolated in a sandbox — never on your bare host — so inference never leaves the box. Sandbox isolation is enforced on supported hosts, and the engine refuses to run a local model unconfined rather than silently degrading. The browser is a thin client that holds no model and no secret — it cannot disclose what it never received.

A blind relay, not a data plane

The broker in the path is a blind relay — it forwards ciphertext it cannot read. The engine is the only thing that ever holds your prompt in the clear, and it runs on your machine. Local models never leave; a hosted model is an explicit per-role choice, routed through one auditable gateway. For your local work, there is nothing in the cloud to subpoena, breach, or mine.
  • Crosses the wire: your request + rendered tokens, encrypted
  • Everything else stays on-device

End-to-end encryption

Encrypted end-to-end. Even on your own machine.

The browser-to-engine channel isn't merely transport security to a relay — it is encrypted end-to-end, so nothing between the two ends — not even the broker that relays it — can read or tamper with the stream.

Authenticated encryption, end-to-end

The channel is authenticated-encrypted end to end. Tampering is detected, not just decoded, and there is no usable plaintext on the wire — the broker and anything else in the path see only ciphertext.
  • Tamper is detected, not just decoded
  • The broker sees only ciphertext
  • Your own machine is treated as hostile, like any network

The same encryption on every surface

The engine, the control-plane services, and the browser client all speak the same encrypted contract, verified in CI — so the Web Console, headless servers, and future surfaces are protected identically.
  • One contract, every surface
  • Verified in CI
  • No weak link to find

The perimeter

No front door to pick.

The engine opens no inbound port — it dials out to reach your browser, so the classic browser-to-server attack surface simply isn't there. What remains is authenticated and encrypted at every hop, in independent layers.

layer 1

No inbound port

The engine binds no socket. It dials out, so there is nothing on your machine for a malicious page or a network scan to connect to — the whole class of DNS-rebind attacks has no target.

layer 2

Origin-locked console

The browser console is locked to a single origin — app.openeng.ai. No wildcard, no substring — one origin can load and drive it, or it's rejected.

layer 3

Paired to your engine only

The broker only ever pairs your browser with your own engine — never anyone else's. There is no way to be routed to a stranger's machine, or a stranger to yours.

layer 4

Authorized per message

Every message is authorized on its own, not once per session — so access can be checked and revoked continuously, not trusted for the life of a login.

Credentials & execution

Short-lived by default. Default-deny on anything that bites.

Credentials are short-lived and scoped to the surface that requested them, and the agent runs inside a real OS kernel sandbox where destructive actions need explicit approval. An agent you can actually leave running.

Short-lived, scoped credentials

Access credentials are short-lived and stamped with the surface that requested them, then silently re-minted. A leaked credential is stale almost immediately and can't be replayed from a different surface.

Real kernel sandbox

Workers execute inside a real OS-level kernel sandbox — read-only root, network off. The agent can't reach what it wasn't granted, even if a tool misbehaves.
  • Read-only root filesystem
  • Network off by default

Default-deny on destructive actions

An always-on guardrail model screens every tool call before it runs. Destructive actions and downloads default to deny — they require an explicit human approval, surfaced right in the console.

Secrets & identity

Secrets stay by reference. Identity stays clean.

The control plane never holds a secret value, and the account system is built on boring, audited standards — no bespoke crypto, no long-lived bearer tokens lying around.

Secrets-by-reference control plane

You author config in the browser, but it stores ${ENV} references only — your actual secrets resolve from the local environment at run time, on your machine, never in the cloud. A breach of the control plane yields names, not values.
  • Config is a mirror, never the source of secrets
  • Secrets resolve locally, at run time

Identity hygiene

Sign-in uses standard browser authorization, with a device flow for headless machines, and only one interactive session is active at a time. API keys are shown once at creation — only their hash is stored, so a dump leaks nothing usable.
  • Standard browser + device sign-in
  • Single active session
  • API keys shown once · only a hash stored

What we never collect

No telemetry. No data plane. No stored cards.

The simplest privacy guarantee is the one where the data never exists. There is nothing to opt out of, because there is nothing being collected.

No telemetry, ever

No analytics SDK, no usage beacon, no crash phone-home. The engine does its work and reports to no one. Your activity is yours.

No readable data plane

The only thing in the path of your work is a blind relay that can't read a frame. Nothing to breach, nothing to subpoena, nothing to quietly mine for training data.

Card data never stored

Billing runs through the payment processor with reserve-then-settle accounting. We keep a non-reversible reference, never your card details.

Our threat model, stated plainly

The one boundary we can't cross — and won't pretend we do.

The same-OS-user ceiling

The engine runs only on your own machine, encrypts every session, and sandboxes every worker. But it runs as you — and it cannot defend against another process already running as the same OS user on the same machine. That is the trust boundary of every local program, and we'd rather state it plainly than imply a guarantee we can't make. If an attacker is already executing as your user, they have your shell; the fix is OS-level user isolation, not a marketing claim. Everything above this line is real, enforced, and verifiable.

See how the engine is built

Trust you can read for yourself.

Run it on your own machine, watch the wire, and verify every claim on this page. Private by construction — no telemetry, no data plane, no compromise.

Install the engine

curl -fsSL https://openeng.ai/engine/install.sh | bash
Open the Web Console Read the docs