---
title: Trust and data boundaries
description: Where PersonaKit data lives, what a model sees, what assistants see, and what is not claimed.
status: pre-release
audience: people who run PersonaKit locally, contributors, and AI assistants
last_verified: 2026-11-12
---

# Trust and data boundaries

## What is true in 0.1

![What stays on your machine and what leaves it: only your own turns go to the model you chose, and only approved and unconfirmed memories, with shortened quotes, go to your assistants](assets/data-boundary.svg)

- **Where data lives:** a SQLite file on your machine. PersonaKit uploads nothing.
- **What a model sees:** only turns you wrote, sent to the model you configure through your own CLI login, under that provider's terms.
- **What assistants see:** only what the MCP server returns, which excludes restricted and hidden memories. Evidence quotes are shortened to 240 characters and email addresses in them are masked; the store keeps the quote as you wrote it.
- **Credentials:** a memory whose text has the shape of a common API key or private key is rejected and not stored.
- **Read log:** each read records the time and two counts (returned, withheld) in the local store. It never records the question or memory text.
- **Statistics:** `personakit stats` prints counts to your terminal. It never includes memory text.
- **Deletion:** `personakit forget` removes a memory and its evidence.
- **Cost control:** each sweep has a call budget you set.

## What is not claimed

- Extraction is a model's guess. Review is how you correct it.
- Quotes supplied through `personakit_propose` come from the assistant and cannot be verified; review labels them.
- A memory an assistant already received cannot be recalled from that conversation.
- Detection of pasted content and secrets is heuristic. Review before sharing a store.
- This documentation is not an independent security audit.

## Reporting a problem

Use private vulnerability reporting on the PersonaKit open-source repository on GitHub.