Privacy & security

Network

• The gateway binds to 127.0.0.1 by default — only local processes can reach it
• The only outbound traffic is the proxied call to your configured provider, plus the summarizer call to the same provider
• No telemetry, no phone-home, no accounts

Credentials

• API keys sent by your harness are forwarded to the provider unchanged
• cmx does not store, log, or transmit keys — not in SQLite, not in config, not in the dashboard

Data on disk

Data	Location	Retention
Aggregated token stats	~/.local/share/cmx/cmx.sqlite	kept
Summaries + message ledgers	same DB	kept
Full request payloads (opt-in, logging.enabled)	same DB	retention_days (default 14), purged hourly

Everything lives under your user account. Delete the data directory and it’s gone.

Caution

Request payloads are your conversation content. They never leave the machine, but they are written to disk when logging is on. Set logging.enabled: false for zero content storage — stats still work.

Hardening

• Keep gateway.host at 127.0.0.1 unless you know you need LAN access
• If you expose the dashboard, put it behind an authenticating reverse proxy
• On shared machines, remember SQLite files are readable by your user by default (use private home directories as usual)