Data and privacy

The majority of data processed by Speedwave never leaves your local computer. Project source code remains strictly local: Speedwave mounts your project directory directly into the container running Claude without uploading files to external repositories. The only project information transmitted to the model provider consists of prompt text entered in chat and files explicitly read by Claude during execution.

Service tokens for integrations (such as Slack or GitHub) remain on your local machine, stored in your home directory with owner-only file permissions and mounted read-only into that specific service worker container. Anthropic authentication follows the same principle: the speedwave login command (or the Desktop “Open terminal and log in” button) executes claude auth login --claudeai directly inside the container without Speedwave intercepting or duplicating credentials.

Storage security model

Speedwave protects files on disk using operating system access controls and file ownership rather than filesystem-level encryption. Access is available to any process running under your local user account.

Outbound data to model providers

When Anthropic is your configured provider, two categories of information reach the model: your chat input and files read by Claude. A local per-project proxy mediates between Claude Code and the model provider. When PII tokenization is disabled, it forwards requests unmodified. When PII tokenization is active (via beta settings or MDM policy), the proxy scans outbound requests, replacing detected personal data, financial identifiers, and API credentials with placeholder tokens before transmission. The model provider receives only stokenized content and never has access to the original values.

Model providers do not receive external integration tokens because the Claude container does not store service credentials. The same tokenization engine inspects data returned from integrations before presenting it to Claude. See Tokenization for detection scope details.

Provider configuration

Each project connects to a single model provider: Anthropic, a self-hosted local model server, or OpenRouter. This configuration is maintained on a per-project basis. Outbound communication with Anthropic and OpenRouter uses encrypted HTTPS connections. Local servers typically communicate via unencrypted http:// across loopback interfaces, which Speedwave flags with a diagnostic log warning. See LLM providers for provider setup guidelines.

Additional third-party network requests

Beyond enabled service integrations, two additional types of network operations may occur. Context7 documentation lookups send your query and target library name to its API endpoint. Context7 may retain query contents for evaluation and ranking benchmarks (including analysis through external LLMs) and does not provide a Data Processing Agreement (DPA) or SLA; generate a free API key if your workflows have strict compliance requirements. In addition, the meeting transcription module supports optional speech model downloads (verified via SHA-256 from Hugging Face or GitHub with SSRF protection).

Meeting transcripts do not undergo automatic expiration or cloud synchronization. They remain on your local system until deleted, and all audio transcription runs locally without streaming audio data over the network.