Syntic Code security and privacy
Syntic Code sends your messages, plus the files and command output the agent reads, to the Syntic platform where the model runs. Conversations, settings and edit backups stay on your own computer. You decide what the agent may read, change and run.
What leaves your computer
| What | Sent to | Can you turn it off? |
|---|---|---|
| Your messages, files the agent reads, command output | The Syntic platform, to run the model | No, this is how the agent works. Block sensitive files with deny rules. |
The model list for /model | The Syntic platform | No |
| A daily check for a new version | Syntic’s release server | Yes |
| Connection warm-up and usage refresh for the status line | The Syntic platform | Yes |
| Anything you add yourself: tool servers, hooks, plugins, web fetches | Wherever they point | You control these |
Set SYNTIC_PRIVACY=essential to stop the optional calls. To opt out of telemetry, set SYNTIC_TELEMETRY=0 (or DO_NOT_TRACK=1). syntic doctor shows the privacy level in force.
What stays on your computer
- Saved conversations and the file backups used by rewind.
- Settings, permission rules and the list of folders you trust.
- Reports saved with
/feedback. Nothing is uploaded unless you send it to us.
Built-in safeguards
| Safeguard | What it protects |
|---|---|
| Folder trust | A cloned project’s settings are ignored until you trust the folder. |
| Approval prompts | Risky commands and edits wait for your OK. |
| Read before edit | The agent cannot change a file it has not read, or one that changed since it read it. |
| Credential isolation | Your sign-in is never passed to commands, hooks or tool servers it starts, and projects cannot set credentials. |
| Dangerous-command blocking | Commands that could do catastrophic damage are refused. |
Keep secrets away from the model
Add deny rules in your personal settings (all projects) or in a project’s .syntic/settings.json (everyone on the team):
{ "permissions": { "deny": ["Read(.env)", "Read(*.pem)"] } }Lost a computer or saw a sign-in you don’t recognise?
On the Syntic website, open Settings › Security and choose Sign out everywhere. It ends every browser, Syntic Code and Desktop sign-in on your account. Tick Also revoke my API keys if keys may be exposed.
How Syntic handles data on the platform side, including retention, is covered in Privacy and legal.