Kucedr is designed to keep you in control of your data and actions. This page states the limits as plainly as the guarantees.
Local By Default
Kucedr's application profile defaults to ~/.kucedr on every platform. Electron runtime data such as Chromium state and crash dumps uses Electron's platform-specific paths.
| Area | Stored data |
|---|---|
settings/ | App, agent, provider, RAG, task, account, channel, and integration configuration. |
workspace/ | The default agent working directory and personalization Markdown files. |
sessions/ | Conversation and session history. |
skills/ | Installed skill instructions. |
apps/ | Managed app files and per-app data. |
library/ | Library and generated media files. |
rag/vectors.sqlite | Local RAG vectors and source records. |
When Data Leaves Your Machine
Prompts, attachments, tool inputs, embedding text, and generated content may be sent to configured model providers, MCP servers, websites, browser targets, messaging channels such as Telegram, or Kucedr account cloud services when required by the operation you requested. Folder backup sends only the folders you explicitly select to the configured storage provider.
Bring Your Own Keys
You use your own provider accounts. Kucedr does not put another vendor between you and the providers you choose.
How Credentials Are Stored
Model, database, and search API keys are stored as entered in settings/providers.json. Bot tokens and MCP secrets use their respective local stores and must also be treated as sensitive. Storage secret keys use secure device storage. Account sessions are encrypted when secure storage is available and otherwise remain in memory. Do not assume that the entire profile is encrypted.
Explicit Permissions
The persistent policy has three buckets: read, write, and exec. Each contains only allow and deny path-glob arrays; there is no saved ask field. The default policy trusts the agent workspace recursively for all three capabilities.
- A matching deny rule always wins, even when an allow rule also matches.
- If no deny matches, a matching allow rule permits the operation.
- If neither matches, reads proceed without approval. File mutations ask when an interactive approval window is available and are denied in background runs.
- The permission card offers Deny, Allow once, and Trust this location. Trusting a location saves a recursive containing-folder glob for that capability.
- Resetting restores the default workspace glob in all three buckets.
- Relative policy paths such as
Desktop/**resolve from your home directory.
Boundaries Worth Knowing
- Normal shell commands run inside the operating-system command sandbox. Writes are confined to trusted exec paths and the runtime temporary directory.
- A command that must write elsewhere declares that location through
additionalRoots. Kucedr asks before spawning it; a one-time approval applies only to that invocation. - Host execution with
elevated: truealways requires interactive approval and cannot be persisted as a trusted location. - Background calls never bypass stored permissions. Because they cannot show a permission card, an Ask result is denied.
- MCP tools marked read-only do not prompt under the default policy. Explicit server approval settings remain in force for other MCP tools.
Hardened App Shell
Renderer windows use Electron sandboxing, context isolation, disabled Node integration, web security, and insecure-content blocking. Production navigation is restricted to local file:// content, renderer capabilities are exposed through typed preload APIs rather than direct Node access, media permission requests are limited to trusted app windows and renderer origins, and native media context menus validate that files sit inside the agent or media data roots.
Embedded app views use an isolated Electron session. Their local-resource protocol is limited to the agent workspace, clipboard reads are denied, and media or display capture is reserved for app windows.
Provider secrets remain readable by trusted renderer code through the provider preload API.
Certification Note
Kucedr does not claim formal regulated-data certification. Review your own AI providers' and connected services' terms for how they handle data you send them.