# Security

**K-S23 — the map leaves, your source never does.** SecondOS uploads a map of your codebase (paths, symbols, signatures, routes, module layout) + embeddings. It never uploads your source bodies. Secrets are detected and redacted, never sent — and surfaced to you, never silently dropped.

- **Local mode (free):** nothing leaves your machine at all — the map lives in `.secondos/`, fully offline.
- **Cloud mode:** the map + vectors sync so tools can read across machines; source stays local.
- **Enterprise self-host:** even the map stays inside your infrastructure.
- **GitHub App holds no `contents` permission** — it literally cannot read your code; it lists repos (metadata) and triggers your own CI to keep the map fresh.
- **Verify it yourself.** The client that runs on your machine (CLI, MCP server, ingest, graph, embed and memory) is source-available at github.com/Preatan/secondos-client, and docs/DATA-HANDLING.md walks the exact lines. It also states the honest edge: prose docs and manifests (.md, package.json) upload as full text, so keep a sensitive doc out of the synced repo or run in local mode.

Your map and memory are yours: export them any time, no lock-in.