Data and security

Your work stays on your computer.
Our server keeps its structure and your settings.

Your requests, messages, documents and results stay on your computer, and so does your code. AlchemyLab's hosted service keeps the structure of the work (ids, states, times, counts and costs) and the settings you chose, which is what it needs to run the checks and reach you on another device.

The same request, on each side.

Anything you or an agent wrote or chose is words and stays on your computer, even a single word such as the name of a document or a one-word answer. The server keeps what the system itself recorded.

On your computer On our server

A request "Add a French greeting to the welcome page", with its description req000182, state review, opened 09:14. No title: a note that the title is on your computer

Its criteria The wording of each criterion How many there are and which are met: 2 of 3

The conversation Every message you and the agents wrote That a message exists, who sent it and when

A decision The question, the options and your answer That it was answered, by whom and when

A document Its name and the full text of every version Its id, its version number and its size

Code Your repository, the branches and every change The commit id, the paths of changed files, lines added and removed

A command an agent wrote The command and everything it printed, also after you answer Always allow for it That it ran, exit code 0, 4.2 seconds

A command you saved What it printed when it ran Its name and command line, because the checks run it by name

The server also keeps the settings you chose: saved commands with their names and command lines, and the configuration of your checks, environments and workflows, including any text in it. It keeps the names of your projects, computers and areas (a computer's own hostname and the name you give it; an area is a label requests are sorted by, such as checkout), and file paths inside a project where a record needs them, such as the files a request changed. It keeps your account, and the things that belong to you across projects: your agents, recipes and hooks, and guidance about how you work. In 3.0 those are stored on the server.

It keeps no folder path of your computer: a saved command names the project's folder as $ALCHEMY_PROJECT_ROOT and your home folder as $HOME, and one that names any other folder of your computer is kept on your computer.

You can check it. Settings, Data shows how many items of content the hosted service holds for a project and when that was checked: "Content held on the hosted service for this project: 0 items". Check now runs it again, and it runs by itself every day.

When our server reads your words.

It reads them from your computer, uses them in memory and keeps none.

Some of the service's work needs words: putting together what an agent is told, and filling a page when you open the app on a phone or another computer. Each time, the words come from your computer for that task and are not stored. So our servers do handle your words while they work for you. They do not hold them afterwards.

Your model provider sees the work.

Agents run on your computer and call the provider you chose, with your own plan or key. We are not in between.

To do the work, the prompts and the file content an agent reads or writes go to that provider, such as Anthropic, OpenAI or Google, under your account and its terms. Those terms decide what the provider may do with them. Our servers make no model calls. With a local model through LM Studio, nothing goes to a provider.

From another device, or with the computer off.

With your computer on, every device shows the full work. With it off, the app shows the shape of the work and says where the words are.

One AlchemyLab runs in the background on your computer and keeps your projects going. Open the app elsewhere and the pages are filled with words read from that computer, through our service, in memory. While the computer is off, nothing works on your projects, and the app shows "On your computer, not connected" where the words would be. They fill back in when it connects. Something you write meanwhile is not sent: the message box keeps your text and says when the computer was last connected.

If you work under an agreement that no content may pass through another party's server, use the app on the computer that runs the project.

Backups, and a lost computer.

Your computer holds the only copy of the words, so AlchemyLab backs them up there every day, to a folder you choose.

The folder is ~/AlchemyLab Backups unless you pick another, and the newest 7 copies are kept. Pick a folder your backup tool or cloud drive covers. A backup holds your words and the key that checks them, and AlchemyLab never sends it anywhere. A restore checks every item against its fingerprint first.

When a new computer replaces the old one, its projects move in two steps: AlchemyLab on the new computer brings the words back from a backup, then takes the projects over.

If the computer is gone and there is no backup, the words kept on it are lost. Settings, Data, Release this project lets the project continue without them: each place shows "Lost with a computer this project was released from", and a receipt on the project's record says how many. A release can be undone for 30 days, so a computer that comes back gets its words back.

What support can see.

The structure, and none of the words.

AlchemyLab support sees what the hosted service keeps: ids, states, times, counts and your configuration, such as command names and file paths. If a request seems stuck, support can see that it waits on a review and since when, and not what the request asks. To show support more, you send the text you choose yourself.

How the words are protected on your disk.

By your disk's encryption and your account's permissions, the same as your project folder.

The words are kept in a store per project in AlchemyLab's folder on your computer. AlchemyLab does not encrypt that store itself, so turn disk encryption on. Provider sign-ins, API keys, your Linear key and the secrets of your MCP connections are also kept only on your computer.

Downloading and deleting.

You can download a project's whole record as one file, and delete what we hold for it in one action.

Download: Settings, Data, "Your record" gives a project's requests, tasks, decisions, documents and conversation in JSON and in Markdown. The words come from your computer, so it has to be connected.
Trim: In the same place you choose how long conversation entries stay in the stream views: forever, 90 days or 30 days. Requests, decisions, questions and documents are never trimmed.
Delete: Deleting a project removes everything the hosted service holds for it, and the response lists what was removed. Your computer removes the project's words the next time it connects.
Our backups: Backups of the hosted service are kept for 14 days. They hold what the service holds: structure and configuration.
In transit: The queue that carries work to your computer is not part of the record. Delivered entries keep only routing information after 7 days, and transport rows are removed after one day.

What agents can do on your machine.

Agents edit files in their own copy of the project. Everything else they do runs in a sealed container or waits for you.

They never change the repository

Each request is worked in its own copy of the project, on its own branch. AlchemyLab does all the branching, committing and merging: an agent that tries a git command that would change the repository is refused, and read-only git still works. Work reaches your project folder through one path, a merge, after its checks. A merge that would overwrite a file you have changed, including one git ignores such as a .env, is refused.

Their commands run in a sealed box

Anything beyond editing tracked files runs in a disposable container: no network, a non-root user with no extra privileges, a read-only root filesystem. Every command, and every connection the box refused, is recorded on the request. A Docker Compose file you bring is cleaned first: host mounts, host networking and privilege escalation are removed. Without Docker, commands run in the operating system's own sandbox or wait for your approval.

You approve what runs

Agents run registered commands. An unknown command waits for you once, and your answer is remembered. Outside a sealed box, a command that reaches the network, such as curl, git push or a package install, always asks you. The Workspace environment runs saved commands on your real project folder: there, safe command shapes run on their own and anything else asks first.

The internet and other tools are yours to grant

The web tools sit behind one switch on the workflow; turn it off and they disappear from every agent in it. The agents that judge work never get them, so nothing fetched can steer a verdict. An MCP server you connect is denied to every agent until a workflow grants it. Tools that write ask before they run, and every call is recorded.

An environment can be loosened when it needs more. These are the four levels.

Confined: The default: sealed as above.
Egress allowlist: Sealed except for hosts you name, such as a package registry.
Privileged: Selected Linux capabilities and root inside the box, still with no open network.
Unsafe: Open internet, root and the Docker socket. A deliberate escape hatch you have to choose.

The server on your machine.

It answers the AlchemyLab app and the tools running on your machine, and nothing else.

A page from any other site is refused before it reaches anything that reads or acts.
The app proves who it is with a ticket our hosted service issues for one project and one signed-in person. A ticket lasts two minutes, and your machine checks it with the hosted service. Nothing that opens your machine is stored on our side.
It only answers requests addressed to localhost, so a site that points its own name at your machine is refused.
What it sends back never runs as a page: an HTML or SVG file from your repository opens with scripts off. It does not serve .git or AlchemyLab's own folder, and does not follow a link out of your repository.
The agent runtime beside it is locked with a password created at each launch, which only AlchemyLab's own processes on your machine hold.

Questions security teams ask.

Does our source code leave our machines?: We do not store it. Code stays in your repository on your computer. When you open the app on another device, what you open is read from your computer through our service, in memory. Agents send what they read and write to the model provider you chose, under your account.
What would a breach of your servers expose?: The structure of the work and your settings: ids, states, times, counts and costs; the names of projects, computers and areas; file paths inside projects; saved commands and the configuration of checks, environments and workflows; plus account details and the agents, recipes, hooks and personal guidance you keep across projects. None of your requests, messages, documents or results.
Can your staff read our work?: No. Support sees the same structure and settings the server keeps. To show more, you send the text yourself.
Is the data encrypted at rest?: The words are on your disk and AlchemyLab does not add its own encryption, so they are protected by your disk encryption and your account, like the rest of the project. Connections to our service use TLS.
Do you train models on our data?: No. We do not train on it, sell it or use it for anything except running AlchemyLab for you.
Which model providers see our data?: Only the one you connect, with your own plan or key. Our servers make no model calls. With a local model, no provider is involved.
What can an agent do on a developer machine?: Edit files in its own copy of the project and run commands in a sealed container with no network. It cannot commit, branch or merge, and a command that reaches the network outside a container always asks first.
What happens to our data if we leave?: The words are already yours, on your disk. Deleting a project removes what our service holds for it in one action, and our backups rotate within 14 days.
Can we run the server ourselves?: Yes. For work where even the structure cannot be on our servers, we set up a self-hosted AlchemyLab server on infrastructure you control.

To arrange a self-hosted server, contact us. For what we collect about your account and how we use it, see the privacy policy. Last updated: October 2026.