The rest
Security and your data
What stays on your machine, what does not, and the boundaries that keep an agent's reach where you put it.
Pragma is built around a local owner, explicit capabilities, and narrow process boundaries. Local-first does not mean risk-free: an agent with tools and a computer can still act on everything you granted it.
Where your data is
Conversations, agent configuration, memory and skills live under ~/.pragma on your own disk. There is no sync, and no copy of your conversations on a server of ours.
What does leave your machine is what you would expect: the content of a turn goes to whichever model provider that agent's engine is signed in to, and a connected app's calls go to that service. Both are the arrangements you set up, and both are visible in the conversation.
Two more things reach Systo. Signing in with your email, which Pragma asks for when it starts, links your connected apps to your account so they follow you to another computer; the service keeps your email address and which computers are signed in, and nothing about your conversations. Sign-in codes are emailed from systo.ai@gmail.com through Composio. A report you choose to send from Settings, Support carries your message, the email you give and whatever you attach, and its screenshot, recording and diagnostics are deleted after 90 days. Emails about a report, the confirmation and any reply, come from systo.ai@gmail.com and go out through Composio, the service behind connected apps, so Composio handles the address you give on the way.
The boundaries
- The harness owns the agent processes and listens only on loopback.
- The window receives whether a credential is configured, never its value.
- A provider's credentials are injected only into the process that needs them, so unrelated agents do not inherit them.
- Risky actions become approval cards rather than implicit permission.
- Local computer control is a separate opt-in, then a separate per-agent choice.
- Paired phones get a default-deny API allowlist and their own revocable token.
- Cloud and VPS backends are validated before they are reused.
Secrets
The same applies to screenshots. Crop tokens, addresses, private repository names and customer data before attaching an image to anything cloud-backed.
Your Pragma licence key is handled the same way: stored with the operating system's encryption (Windows' data protection, or the macOS Keychain), held in the main process, and never given to the renderer. If that encryption is unavailable, Pragma refuses to store it rather than writing it out in plain text.
Your part
- Read the approvals, especially shell commands, file writes, and actions in connected services.
- Use an isolated computer backend for anything untrusted or destructive.
- Keep each agent's connected apps down to what its job needs.
- Revoke a lost companion device immediately.
- Keep both Pragma and your agent CLIs current.
Shared machines
Pragma assumes the logged-in Windows or macOS user owns the workspace. On a shared machine another administrator may be able to read application data or inspect processes. A separate operating-system account is the real boundary; the app is not one.
The Windows installer is not signed
Not yet, and it is the most visible gap. Windows SmartScreen says "unknown publisher", and some browser security extensions warn on the download. Verify that a download came from trypragma.xyz before running it, and see Troubleshooting.
The Mac app is signed with a Developer ID and notarized by Apple, so macOS checks it before it first opens and shows no warning.