Data boundaries
Hansard is local-first, but its archive can contain source code, credentials, local paths, personal messages, tool output, and files read outside the current repository. Treat the entire Hansard home as private data.
What stays local by default
Section titled “What stays local by default”Hansard reads supported provider stores and writes its own state under
~/.hansard/. Set HANSARD_HOME to use an isolated Hansard home. Local state
can include:
- normalized transcripts, canonical events, metadata, Markdown conversations, and pre-built viewer payloads;
- byte-preserved provider sources in session
.raw/directories and sharedraw-sources/stores; - attachments and captured artifacts stored as bytes;
- memory snapshots and their history;
- local search indexes, supervisor state, configuration, and credentials; and
- Deep Recall research threads, which stay outside the normal session index and are device-local by default.
Deleting a conversation from its original provider does not delete Hansard’s copy. Deleting the local copy does not delete data already sent to a remote bucket, Slack, a model provider, a hosted viewer cache, or a storage provider’s version history.
Redacted and unredacted data
Section titled “Redacted and unredacted data”New interactive setup enables built-in pattern redaction for normalized text
unless --no-redaction is selected. Existing installations keep their current
redaction configuration.
Redaction is deliberately limited:
| Data | Redaction behavior |
|---|---|
| Normalized message and event text | Pattern-based rules apply when redaction is enabled. |
| Raw provider backups | Preserved substantially byte-for-byte and never redacted. |
| Optional reveal cache | Unredacted so eligible local sessions can be reprocessed. |
| Binary attachments and captured artifacts | Preserved as bytes; contents are not inspected or redacted. |
| Message text containing paths or unrelated material | Only changed when a configured pattern happens to match. |
Pattern redaction is defense in depth, not semantic review. See Redaction for the exact rule and reprocessing behavior.
Features that cross the machine boundary
Section titled “Features that cross the machine boundary”Every outbound feature is optional and separately configured:
| Feature | What crosses the boundary |
|---|---|
| Personal Sync | The complete personal archive, including memories, raw provider backups, attachments, and artifacts. |
| Teams | Whole matched sessions: normalized transcripts, tool content, metadata, attachments, and artifacts. New Team uploads exclude raw backups and memories. |
| Hosted viewer | Everything the viewer process can read becomes available to authenticated browsers. |
| Slack | Configured summaries, digest data, or conversation turns are posted to Slack from redacted archive output. |
| Remote classification | A bounded, redacted evidence digest is sent to the selected non-local backend. A loopback local-model backend stays on the machine. |
Teams remove structural filesystem paths from shared metadata, but they do not rewrite full messages, tool calls, tool results, attachments, or artifacts. Those objects can still disclose local paths or content from outside the Team’s repository selector.
Credentials and destination controls
Section titled “Credentials and destination controls”Remote credentials can live in Hansard configuration, a restricted local token store, or environment variables, depending on the feature. Use the narrowest practical permissions:
- one private bucket or prefix for Personal Sync;
- one fresh bucket or prefix for each Team;
- repository-scoped Team selectors;
- channel-specific Slack routes; and
- short-lived or narrowly scoped storage credentials where the provider supports them.
Hansard does not make an over-permissioned bucket, Slack workspace, local user account, or reverse proxy safe. Anyone who can read a destination can read the data already sent there.
Retention and incident response
Section titled “Retention and incident response”Normal sync is non-destructive: a missing local file is not treated as a remote delete. Slack messages, object versions, snapshots, retention copies, and provider backups must be removed with the destination’s own controls.
Do not attach a real archive, transcript, configuration file, raw provider
store, or identifying screenshot to a public issue. Reproduce problems with
synthetic content and report suspected vulnerabilities through the private
channel documented in the repository’s SECURITY.md.
Threat-model limits
Section titled “Threat-model limits”Hansard does not protect data from another process or account that can read the same files, a compromised provider history store, a browser or proxy with access to a hosted viewer, or credentials with excessive remote permissions. Review the actual session contents and destination before enabling any sharing feature.