Data path
Does Reality Graph send my code to the cloud?
No. Your repository, your runs and your evidence stay on your machine, there is no telemetry, no account and no licence server. Exactly two optional paths can send anything out, both are triggered by an explicit action, and both are named below rather than buried.
Last updated:
Start here
The two cases where something does leave
A local-first page that hides its exceptions is worth nothing to the person who has to sign off on it. So the exceptions come first.
| Path | What leaves | How to switch it off |
|---|---|---|
| The optional model-assisted criteria review | The context pack for that run, after scrubbing, to the provider behind your authenticated Codex CLI. | Do not select the step. It is explicitly chosen, never a default, and it never sets the verdict. |
| The optional revocation refresh | One request to a URL you supply, to fetch a signed revocation list. No repository content is involved. | Do not run the refresh command. It runs only when you invoke it, and an offline file import does the same job. |
Everything else is local. The indexing layer imports five standard-library modules and nothing that speaks a network protocol, and its tokenizer self-test blocks sockets to prove it. The local dashboard binds 127.0.0.1, refuses any other bind address, ships its own assets and loads nothing from the internet.
By design
What stays, and how you check it yourself
Every line below is observable behaviour: what imports what, what binds which address, what refuses to run. Statements about intent do not belong on a page like this.
Stays on your machine
- Your repository. Reality Graph reads it and does not copy it anywhere.
- Runs, reviews and receipts, in a local store that survives restarts.
- The code index, built from five standard-library imports with sockets blocked in the self-test.
- Your entitlement check, verified offline against public keys inside the package.
- Your exports, as plain JSON or Markdown, scrubbed of home paths and secret-shaped strings.
Does not exist
- Telemetry, usage reporting or crash reporting of any kind.
- An account system, a login or a licence server.
- A certification. None is held, and none is claimed at any price.
- An air-gapped mode. Running without a model is a per-command choice, not a verified mode.
- Complete secret detection. Scrubbing uses a fixed pattern list, and an audit found two shapes it missed.
Validated on Linux with Python 3.12. Windows and macOS are unverified in the current release matrix.
What actually goes into a prompt is decided in the context pack, and the broader security posture is covered on the security page.
Questions people actually ask
- Does Reality Graph send telemetry or usage analytics?
- No. There is no telemetry, no usage reporting and no crash reporting. The only outbound request Reality Graph itself can make is the optional revocation refresh, and it runs when you invoke it.
- Do I need an account, a licence server or an activation call?
- No. Entitlements are verified locally with Ed25519 signatures against public keys shipped in the package: no licence server, no activation call, no hardware fingerprinting. Reading and exporting your own data is never gated behind an entitlement.
- Is Reality Graph GDPR compliant, ISO 27001 or SOC 2 certified?
- No certification exists and none is claimed. What this page can tell you is what the software does, byte by byte, so that your own assessment has something factual to stand on. The assessment itself stays with you and your data protection officer.
- Is there an air-gapped mode?
- No, and the word matters. Running a deterministic review without a model or a network is a per-command choice, not a named mode, and no end-to-end air-gapped path is tested. Calling it an air-gapped mode would promise a guarantee that was never verified.
Check the claims rather than believing them
Every statement here is about observable behaviour: what imports what, what binds which address, what refuses to run. Ask for the detail and you get it.