Privacy and control

Security

See where your LocalEndpoint Connect messages, model replies, and optional plugin data go, including local approval and website privacy boundaries.

See local data flow Review network behavior Report a security issue

Your local data path

What happens when you send a message

For local chat, the website is not in the loop: the app, model, reply, and local memory remain on your Windows PC.

You type in Connect
Your message starts in the Windows app, not on LocalEndpoints.com.
Your model answers on this PC
Connect sends it to your selected local model—not a hosted AI provider.
The answer comes back to Connect
The reply and local memory stay on this computer.
Protected requests wait for a decision
Protected requests pause for a local decision. This website cannot approve or run them; not every action is proven in this build.

Optional connection Remote and shared-memory features use a different path.

RemoteEndpoints and MemoryEndpoints require separate setup and stay off until locally enabled. MemoryEndpoints live save-and-search is not proven end to end for this build.

View detailed network behavior

Network behavior

When LocalEndpoint Connect uses the network

Local-only chat does not mean the app never uses a network. These are the current, bounded connection paths.

Activity	Destination	When	What leaves your computer
Visit this website	LocalEndpoints.com	When you open a public page or download	Normal web request data; no app prompts, model responses, local files, or runtime telemetry
Release check	LocalEndpoints.com release metadata	When the app launches	A request for public release metadata; no automatic download or install
Browse or download a model	Hugging Face Hub	Only when you open the catalog or approve a download	Catalog/download requests; no chat prompt or generated response
Run local chat	Your device and local worker	After you choose a local model and approve readiness	No prompt or model response is sent to this website or a hosted model provider
Use RemoteEndpoints	RemoteEndpoints.com	Only after separate plugin install, sign-in, local enablement, and approval	The approved remote workflow data described by that optional plugin
Use MemoryEndpoints	MemoryEndpoints.com	Only after separate plugin setup and an owner-provided workspace key	Hosted-memory behavior remains experimental and is not proven end to end for this exact build

Privacy and accounts

Local-only use does not need a website account

Account use is optional and separated from local chat. When you choose an account feature, the data path changes visibly.

Local-only app: No website account, email address, or password is required after the app and model files are present.
Website account: Only the dedicated register and sign-in routes collect an email address and password. The server stores a salted PBKDF2-SHA256 password hash, not the plaintext password.
Session: Successful website sign-in sets a Secure, HttpOnly, SameSite=Lax session cookie. Signing out revokes the server session and clears the cookie.
Email verification: The account route can send the verification email through Mailgun when configured, so the account email address is shared with that delivery provider.
LocalEndpoint Connect: The Windows app opens the website for account authentication and does not collect or store the website password.
Optional plugins: RemoteEndpoints needs an authenticated account plus local enablement and approval. MemoryEndpoints uses a separate workspace key stored in Windows Credential Manager.

Security contract No localhost probing No upload intake Website credentials only on account routes Plugin keys only in local Settings No command dispatch

Security boundary matrix

What can happen here is smaller than what the product can become.

The public site can explain, publish contracts, validate local files in the browser, and link to evidence. It cannot operate a visitor's machine.

Allowed here Serve public metadata

Docs, examples, schemas, route indexes, discovery files, and quality gates are safe public artifacts.

Allowed here Validate in the browser

Manifest checks run in the tab and can export redacted receipts without sending payloads to the site.

Local only Approve endpoint access

Future Desktop approval belongs on the user's device, with visible consent and reviewable receipts.

Denied here Probe localhost

No scan, fetch, socket check, service discovery, or private-network access is performed by the public site.

Denied here Request app secrets

Product, docs, download, and validation pages request no password, token, private log, or raw endpoint file. Account credentials stay on dedicated account routes.

Denied here Dispatch commands

No browser click on LocalEndpoints.com launches desktop work, runtime execution, installer actions, or autonomous control.