Trust

What is enforced, and where.

What C-Series and Privatae can and cannot do, said plainly: on your own computer, on a managed machine, and for Hosts on the Privatae platform.

On your own computer

C-Series runs on your machine, and we cannot reach it. C-Series is not released yet; this describes its code.

It sends us nothing about you
A Host on your own computer asks privatae.ai for the bastion's signed release list, so our servers see that request. Nothing else goes to Privatae unless you join the network with a membership.
Only your computer can open it
Its dashboard listens on 127.0.0.1 only, inside a Linux virtual machine on your computer.
Its containers are locked down
They run as a normal user, on a read-only filesystem, with every capability dropped and a seccomp profile.
Its code is open
C-Series is licensed AGPL-3.0-only. The source is published with the first release.

What the agent can do to its own memory

These hold wherever C-Series runs, because they are how the code is written.

It writes memory in the open
A memory is a tool call in the agent's own turn. No second model decides what to keep.
Nothing rewrites it in the background
No consolidation, decay or merge pass runs on what it knows.
It cannot erase
Its forget closes an entry, which stays on record. It cannot touch your conversations or your taught rules.
You can fix any entry
Correct, archive or permanently delete a single memory in the Memory app.

On a C-Series Cloud machine Waitlist open

We run the server it is on, so we can reach some of it. This is all of it. The full network security posture is on the C-Series Cloud page.

What we can reach

The server your machine runs on, a server we rent from OVHcloud, and that server's console. They reach the machine's disk, where your Host's data is encrypted under your keys, and, while it runs unlocked, its memory, which holds the key that opens the disk and what your Host is working on. We use them that way only to recover a machine that cannot recover itself.
Backups of the machine's disk: we take none. Your Host takes its own encrypted backups once you give it a backup recovery key; until then it takes none. It keeps them on the machine unless you choose other storage in its settings.
The heartbeat each machine sends every five minutes. We keep only the latest one. When it reports that the machine restarted and is waiting for you to unlock it, or that it was unlocked, that is added to your access log.
Your machine's setup code, until the machine reports its setup finished. Then we delete it.
Your account email and your billing records with Stripe.
The signed updates your machine installs. Each one is code that runs on your machine, is signed, and comes from open source.

What we cannot

An SSH login. The SSH server is removed before the machine is handed over, with every key that could sign in through it.
A network connection into it. The heartbeat goes out from the machine; nothing of ours connects in.
Your sign-in and your disk keys. You unlock your machine with a passkey on its own unlock page, and you download your recovery key yourself. Neither is ever sent to us. Your machines page sends the setup code to your machine when you press Set up your machine; it is never shown to you.
Your model requests on the network. They go from the machine to the model provider you pick, under your own key, and through no service of ours.

OVHcloud, the provider we rent the servers from, runs the hardware and the data centre.

Hosts on the Privatae platform

A Host on the Privatae platform, which we offered before October 19, 2026, runs on systems we operate, so our staff and automated checks can reach inside it. The Privacy Policy says exactly what that covers, including which backups we can open.

What it doesn't do

This isn't an audit. These statements describe the code as it stands; where a line is marked as a waitlist, it is not built yet. If you find one that is wrong, write to [email protected].