> ## Documentation Index
> Fetch the complete documentation index at: https://012e27a-docs-2.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://012e27a-docs-2.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://012e27a-docs-2.manicule.dev/api/mcp.
> Every agent surface: https://012e27a-docs-2.manicule.dev/.well-known/llms-manifest.json

# Security & Privacy (/security/overview)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 563 · updated: 2026-11-12 -->
Related: [Data Privacy & Zero Code Training](/security/privacy.md), [Encrypted Token Vault](/security/token-vault.md), [Execution Isolation & Security](/security/sandboxing.md), [Database Migrations & ORM Setup](/databases/migrations.md)

> Zero code training, an encrypted token vault, and execution isolation across Desktop and Cloud Studio.

BhaiCode is built so your code, credentials, and machines stay yours. Three guarantees
underpin every page in this section.

<CardGroup cols="3">
<Card title="Your code is not training data" icon="lock" href="/security/privacy">No model training on your code, prompts, schemas, or metadata.</Card>

<Card title="Credentials stay encrypted" icon="key-round" href="/security/token-vault">AES-256-GCM at rest, per-tenant keys, TLS 1.3 in transit.</Card>

<Card title="Execution is isolated" icon="shield-alert" href="/security/sandboxing">Path denylists, approval gates, and ephemeral build containers.</Card>
</CardGroup>

## How the controls fit together

```mermaid
flowchart LR
    YOU["Your machine"] -->|"prompt + minimal context"| BHAI["Bhai"]
    BHAI -->|"tool call"| GATE{"Risk tier"}
    GATE -->|"read-only"| AUTO["Runs automatically"]
    GATE -->|"workspace edit"| DIFF["Staged in diff viewer"]
    GATE -->|"shell / system"| APPROVE["Waits for approval"]
    BHAI -->|"direct request"| LLM["AI provider"]
    LLM -->|"no retention, no training"| BHAI
```

| Control              | Desktop Workspace                                                   | Cloud Studio                                        |
| -------------------- | ------------------------------------------------------------------- | --------------------------------------------------- |
| Source code location | Your local filesystem                                               | Ephemeral build containers                          |
| Secrets storage      | OS keychain                                                         | Encrypted token vault (AES-256-GCM)                 |
| Command execution    | Your shell, gated by the [Transparency Dock](/desktop/transparency) | Isolated browser sandbox and short-lived containers |
| Context scope        | Only files needed for the task; `.env` and `.gitignore` respected   | Same, plus explicit `@file` pinning                 |

<Note>Enterprise deployments can request zero-data-retention terms from upstream model providers.
[Contact the team](mailto:hello@bhaico.de) for the current security summary.</Note>