Data boundaries

Hansard is local-first, but its archive can contain source code, credentials, local paths, personal messages, tool output, and files read outside the current repository. Treat the entire Hansard home as private data.

What stays local by default

Hansard reads supported provider stores and writes its own state under ~/.hansard/. Set HANSARD_HOME to use an isolated Hansard home. Local state can include:

normalized transcripts, canonical events, metadata, Markdown conversations, and pre-built viewer payloads;
byte-preserved provider sources in session .raw/ directories and shared raw-sources/ stores;
attachments and captured artifacts stored as bytes;
memory snapshots and their history;
subscription quota history plus normalized account display email and Claude organization name in a private 0600 state file;
local search indexes, watcher state, configuration, and credentials; and
Deep Recall research threads, which stay outside the normal session index and are device-local by default.

Subscription display metadata is excluded from archives, sync, and logs. The viewer removes it from non-loopback responses and exposes it to authenticated requests arriving on the loopback interface so historical account rows remain identifiable. Provider account and organization IDs remain opaque fingerprints.

Deleting a conversation from its original provider does not delete Hansard’s copy. Deleting the local copy does not delete data already sent to a remote bucket, Slack, a model provider, a hosted viewer cache, or a storage provider’s version history.

Review boundaries in the app

Open Settings → Privacy & Sharing for the installation’s current outbound summary. The page shows whether the local unredacted reveal cache is retained. The Outbound subsystems card shows whether cloud or Team sync is connected and whether Slack posting is enabled. Its management links open Personal Sync, Teams, and Slack so the actual destination, selector, and delivery policy can be reviewed where each feature is configured.

This page is a status and routing surface, not a claim that archived content is safe to share. Before enabling an outbound feature, open representative sessions in Conversations, expand their tool calls and attachments, and inspect the destination-specific warning. Settings → Classification separately shows whether a chosen backend is local or sends a bounded digest to a model provider.

Redacted and unredacted data

New interactive setup enables built-in pattern redaction for normalized text unless --no-redaction is selected. Existing installations keep their current redaction configuration.

Redaction is deliberately limited:

Data	Redaction behavior
Normalized message and event text	Pattern-based rules apply when redaction is enabled.
Raw provider backups	Normally preserved substantially byte-for-byte. OpenCode removes audited legacy share secrets, and OpenCode/MiMo SQLite backups publish a credential-safe history projection; the raw manifest records these exceptions.
Optional reveal cache	Unredacted so eligible local sessions can be reprocessed.
Binary attachments and captured artifacts	Preserved as bytes; contents are not inspected or redacted.
Message text containing paths or unrelated material	Only changed when a configured pattern happens to match.

Pattern redaction is defense in depth, not semantic review. See Redaction for the exact rule and reprocessing behavior.

Features that cross the machine boundary

Every outbound feature is optional and separately configured:

Feature	What crosses the boundary
Personal Sync	The complete personal archive, including memories, raw provider backups, attachments, and artifacts.
Teams	Whole matched sessions: normalized transcripts, tool content, metadata, attachments, and artifacts. New Team uploads exclude raw backups and memories.
Hosted viewer	Everything the viewer process can read becomes available to authenticated browsers.
Slack	Configured summaries, digest data, or conversation turns are posted to Slack from redacted archive output.
Remote classification	A bounded, redacted evidence digest is sent to the selected non-local backend. A loopback local-model backend stays on the machine.

Teams remove structural filesystem paths from shared metadata, but they do not rewrite full messages, tool calls, tool results, attachments, or artifacts. Those objects can still disclose local paths or content from outside the Team’s repository selector.

Credentials and destination controls

Remote credentials can live in Hansard configuration, a restricted local token store, or environment variables, depending on the feature. Use the narrowest practical permissions:

one private bucket or prefix for Personal Sync;
one fresh bucket or prefix for each Team;
repository-scoped Team selectors;
channel-specific Slack routes; and
short-lived or narrowly scoped storage credentials where the provider supports them.

Hansard does not make an over-permissioned bucket, Slack workspace, local user account, or reverse proxy safe. Anyone who can read a destination can read the data already sent there.

Retention and incident response

Normal sync is non-destructive: a missing local file is not treated as a remote delete. Slack messages, object versions, snapshots, retention copies, and provider backups must be removed with the destination’s own controls.

Do not attach a real archive, transcript, configuration file, raw provider store, or identifying screenshot to a public issue. Reproduce problems with synthetic content and report suspected vulnerabilities through the private channel documented in the repository’s SECURITY.md.

Threat-model limits

Hansard does not protect data from another process or account that can read the same files, a compromised provider history store, a browser or proxy with access to a hosted viewer, or credentials with excessive remote permissions. Review the actual session contents and destination before enabling any sharing feature.