Protection built into the workflow#
Moving a coding session means handling more than chat messages. A session can include source code, file changes, tool output, and agent configuration. Ondago treats protecting that material as a core product requirement across the CLI, Desktop, and Web apps.
The design combines client-side encryption, registered devices, workspace access controls, and explicit decisions when you move work or credentials. Understanding these protections helps you choose where to run a session and who to share it with.
Sessions are encrypted before they leave the client#
When you lift a session, the client encrypts the captured transcript and project content before uploading the bundle. Session titles are also encrypted. A device with the required keys decrypts the content when you open it.
Bundles use the age encryption format with X25519 recipients and authenticated encryption. The storage API receives encrypted content and does not hold the plaintext workspace key needed to open it. Session reading and title decryption happen on the client.
Live relay traffic is encrypted between the session host and the connected client using a session key. The relay forwards encrypted frames; it does not need the plaintext conversation or terminal input to deliver them.
Device identity and encryption access work together#
Account sign-in identifies you. An authenticator code or an emailed verification code registers a new device when that method is available. Opening encrypted workspace content also requires that device to receive the workspace key.
The workspace key is created on a client and encrypted separately for registered devices. The API stores those encrypted copies and public keys, rather than the plaintext private key. This lets an authorized new device open existing sessions without the storage service decrypting them.
A session URL or QR code points to a session; it does not replace sign-in, workspace membership, or decryption access. Follow the registration and key-transfer prompts on each new computer or browser profile.
Temporary reading copies are private to the computer owner#
View planned changes for Temporary reading copies are private to the computer owner. Availability depends on the released app and host versions.
Share within a deliberate trust boundary#
Workspace membership and roles determine which account operations are permitted. Encryption keys determine which stored content a device can open. Both are part of the access model.
Treat a shared workspace as a shared trust boundary. Agent-provider credentials saved to a workspace are encrypted on the client, but devices with access to that workspace’s key can decrypt them. Use credentials intended for that workspace and review membership when sharing sessions or enabling cloud work.
You can revoke a device through Devices or ondago devices revoke DEVICE_ID. Revocation removes its server-side access; it cannot erase downloaded content or keys already held by the device. If a provider credential was exposed, rotate it with the provider as well.
Cloud continuation has an explicit execution boundary#
For cloud continuation, the client encrypts a copy of the selected session to a key generated by the destination runtime. Credentials supplied for the run are also encrypted to that destination. The runtime receives what it needs for the run rather than the workspace’s private vault key, which would open other stored sessions.
The cloud agent must decrypt the supplied session and use its credentials to do work. The runtime and the infrastructure operating it are therefore inside the trust boundary for that execution. Your chosen coding agent and model provider may also process the content sent to them under their own settings and policies.
Encryption of stored bundles and relay traffic protects those paths; it does not make the running agent blind to the project. Before continuing in the cloud, review the session, captured project content, repository access, and credentials being supplied.
To keep execution on your own computer, use a locally hosted session and connect to it from your phone. To save a snapshot without starting a cloud run, use ondago lift -no-cloud. See Continue anywhere for the workflows.
Know what the service can see#
| Data | How it is handled |
|---|---|
| Stored session content and titles | Encrypted before upload; opened by clients that hold the required keys. |
| Live conversation and terminal traffic | Encrypted between the host and connected client as it crosses the relay. |
| Workspace agent-provider credentials | Stored as client-encrypted values; available to devices with the workspace key and to a runtime when supplied for its run. |
| Task connections (workspace-enabled preview) | The API processes requested provider task content and holds server-encrypted OAuth credentials. Session associations remain client-encrypted. See the Task connections guide for scope and availability. |
| Account and operational metadata | The service processes information needed to operate, such as account identity, workspace membership, resource IDs, sizes, timestamps, agent type, host labels, connection status, and the Ondago Desktop and CLI versions your apps report. |
| Support messages | Messages you submit through Contact us are readable by support. Include only the information needed to explain your issue. |
Encryption of session content does not mean that every piece of account or operational data is encrypted from the service. See the privacy policy for how personal information is handled.
Checks accompany installation and transfers#
The official installers verify downloaded artifacts against the published SHA-256 checksums by default. Keep verification enabled and follow the installer’s error if a download cannot be verified. See CLI installation or Desktop installation.
When moving between agents, the compatibility report exposes configuration differences, including permissions and hooks. Required choices are tied to the reviewed transfer. Read those differences before applying them; an instruction or permission understood by one agent may behave differently in another.
Choose what a capture includes. The CLI offers -no-code to omit the working tree, -no-env or -no-harness to omit agent configuration, and -no-history to omit Git history. These narrow the capture; they do not redact secrets already present in the conversation. Review the content you intend to share.
Recovery and local devices remain part of security#
Keep the recovery kit outside the browser or computer it protects, in a private location you can still access if that device is lost. Recovery material can restore access to encrypted work; treat it as a secret and never include it in screenshots, logs, or support messages.
Device keys and decrypted content exist on the clients that use them. Protect those computers and browser profiles. Clearing browser site data can remove local keys and require registration or recovery again.
Report a security concern#
Email team@ondago.ai with a description of the concern and the affected app or CLI version. Use a minimal example with fictional data. Leave out passwords, API tokens, private keys, recovery material, and private session content.