security

What leaves the machine, and when.

Chief has no backend. There is no Chief account, no Chief server and no Chief telemetry endpoint. Outbound traffic goes to the tools you connected yourself, on tokens you issued, plus one download of the model weights — listed below in full.

architecture

Chief (Tauri app)

your desktop session

HTTP →
loopback

llama-server

127.0.0.1:11435 · Llama 3.2 3B

reads →

SQLite work log

app data dir · mode 0600

engine is bundled

The llama.cpp server ships inside the installer and is started and stopped by Chief as a child process on loopback. There is no separate runtime to install, nothing left running once you close the app, and no hosted model anywhere in the path.

Data at rest

Work log — one SQLite file in the app data directory, set to mode 0600 so only your user account can read it. Delete the file and the log is gone; there is no copy.

Integration tokens — in that same SQLite file, as plain text, protected by your OS user account rather than by encryption. Moving them into the OS keychain is a known improvement and is not done yet. They are never logged and never returned to the interface.

Your notes and drafts — ordinary markdown files in a folder you choose, editable in your own editor and readable long after Chief is gone.

Model weights — one GGUF file in the app data directory, downloaded once and never re-fetched.

Questions and answers — kept locally. No third party retains them because no third party sees them.

Network, in full

127.0.0.1:11435 Model inference — the bundled engine

huggingface.co Model weights, once. No token, no cookie

github.com · api.github.com If you connect GitHub

api.linear.app If you paste a Linear key

auth.atlassian.com · mcp.atlassian.com If you connect Jira

your calendar provider If you paste a subscription address

That is the whole list, and every row after the first two is a service you connected yourself. There is no update check and no crash reporter. The inference client refuses any address that is not loopback — a test asserts it rejects a public host — so a misconfigured base URL fails closed rather than sending your log elsewhere.

Your own OAuth registration

An organisation that would rather not use Chief’s registration can point the app at its own GitHub OAuth app or Entra registration — an environment variable, or a client ID pasted into Settings. No rebuild.

Air-gapped

Once the weights are on disk, the brief, the work log and the conversation all run with the network off — the engine is already on the machine. Integrations simply stay disconnected.

Verify it yourself

The source is public and the paths above are the ones in it — the loopback refusal and its test are a file you can open. Run the app behind a proxy and compare; that is the point of shipping local.

Two things to know before a security review. Builds are not yet code-signed or notarised, so macOS and Windows will warn on first launch, and the Linux bundles are unsigned too. And Chief asks GitHub for the repo scope, which is read and write across public and private repositories — broader than it uses, because GitHub offers OAuth apps no read-only scope for private repositories. Jira is the opposite case: no write scope is requested at all, so read-only there is enforced by Atlassian rather than promised by Chief.