# Security and privacy

## Your work stays on your machine

Threads, history and settings live in a local daemon next to your code. Your agents run on your computers, never on our servers.

## Credentials stay with each CLI

Every agent runs through its own logged-in CLI and talks to its own provider. ace never asks for, stores or proxies a key.

## Remote access is yours to grant

Machines and phones join only when you pair them or sign them in to your ace account. From anywhere, they connect with end-to-end encryption, so the relay can't read your work.

## Every line is open

ace is Apache-2.0. Read the daemon, the clients and the architecture decisions behind them on GitHub.

## Questions

### Does ace need my API keys or a new subscription?

No. ace runs each agent through its own logged-in CLI, so your existing subscriptions and logins keep working. ace never asks for, stores or proxies provider credentials.

### Where does my code go?

ace runs on your own machines; your agents and code never run on our servers. Your code goes only where your agent CLI already sends it. Devices reach your machines directly over your local network or Tailscale, or through ace's relay, which is end-to-end encrypted and can't read what it forwards. You can also host the relay yourself.

### Who decides what an agent may run?

The agent's own CLI, in the permission mode you chose for it. ace adds no approval layer of its own and never answers an approval for you.

### Can another device control my agents?

Only devices you pair, with the access you choose (view only, or view and act, for as long as you set), and devices signed in to your ace account. A machine code makes even those enter a PIN or password before they get in. Each machine also decides how much other linked machines may do on it.

### What can ace's relay see?

The addresses and timing of a connection and the size of its encrypted messages. Traffic between your devices and your machines is end-to-end encrypted, so the relay can't read prompts, code or screens, and it keeps nothing after the connection ends.

Page: https://acehq.dev/security/