Data and privacy
Most of what Speedwave touches never leaves your computer. Your project code stays local: Speedwave mounts your project directory into the container where Claude runs, without uploading your repository anywhere. The only project data reaching the model is what you share in chat, or the files Claude reads.
Service tokens for integrations like Slack or GitHub stay local too, stored under your home directory with owner-only file permissions and mounted read-only into that one service’s worker and nowhere else. Your Anthropic login works the same way: speedwave login (or the Desktop “Open terminal and log in” button) execs claude auth login --claudeai directly inside the container. Speedwave never parses or mirrors that credential.
What the model provider sees
Section titled “What the model provider sees”When Anthropic is your configured provider, two things reach the model directly: the text you type in chat, and the project files Claude reads while it works. A small per-project forwarder sits between Claude Code and the provider and relays the request, adding nothing of its own.
The model never sees your service tokens: the container where Claude runs holds no external service credentials, and a token is only mounted into that service’s own worker. Data that integrations return is different. Speedwave runs it through a tokenizer first, replacing sensitive values like email addresses, card numbers, and API keys with placeholders before Claude sees them. That process has limits and skips your chat text and project files. See Tokenization for what it detects and where it stops.
Provider choice
Section titled “Provider choice”Each project picks one model provider: Anthropic, a model server you host yourself, or OpenRouter. The choice is per project, so one project can run on the Anthropic subscription while another talks to a local server. Traffic to Anthropic and OpenRouter goes over HTTPS; a local server is typically reached over plain http:// on the loopback interface instead, and Speedwave logs a cleartext warning when it does. See LLM providers for how to set up and switch providers.
Other third-party calls
Section titled “Other third-party calls”Beyond the integrations you enable, two calls exist. Context7 lookups send your query and library name to its API; Context7 may retain that query for benchmarking and reranking, including through external LLMs, and offers no data-processing agreement (DPA) or service-level agreement (SLA), so generate a free API key if you’re compliance-sensitive. Meeting transcription triggers an optional speech-model download, SHA-256 verified, from Hugging Face or GitHub, SSRF-checked.
Meeting transcripts have no automatic retention. They stay on your machine until you delete them, and transcription runs locally, so no audio leaves your machine to be transcribed.