System status
See the current health of Cuttlefish services and where to follow updates if something is being worked on. Check system status.
Trust Center
Trust controls you can inspect.
Cuttlefish keeps a simple promise: nothing reaches an outside AI provider or tool unless you choose it, what is saved to your account is stated plainly, and you can see exactly what happened. This is where the promise is laid out plainly, with links to every detail.
Trust at a glance
Everything that backs the promise, in one place.
Six places to look when you want the specifics — current service health, how we handle your data, the legal terms, and the security details a reviewer needs.
Privacy
What Cuttlefish keeps, what it never sends, and the choices you control — written for a person, not a lawyer. Read the privacy policy.
Terms of service
The agreement that covers using Cuttlefish, in clear sections you can actually read. Read the terms of service.
Data processing
For teams and companies: how data is handled on your behalf, and the addendum your procurement team will want. Review data processing.
Subprocessors
The outside services Cuttlefish relies on to run the hosted side, listed openly. See the subprocessor list.
Security model
The deeper security details a reviewer or IT team needs, including how to report something. Read the security model.
Data handling & residency
Your data stays where you put it.
Cuttlefish starts on your computer. Your files stay there, a model you run there needs no outside provider, and what is saved to your account is laid out plainly on the privacy page.
No provider unless you choose one
Your files, connected folders, and built apps live on your computer, and nothing is sent to an outside AI provider unless you choose one. When you run a model on your own machine, your prompts and its answers are processed on that machine. Your conversation history and memories are saved to your Cuttlefish account so they are available on your devices.
On device vs. in the cloud
An approved cloud model receives the conversation and context selected for its request, which can include relevant file excerpts, images, or tool results. Provider retention and training terms depend on your provider account and agreement. Optional settings backup is separate from hosted conversation history and memories; turning backup off does not turn off that account storage.
Keep, delete, or export — your call
You can review saved work, remove connected folders without deleting their original files, and use the available export and reset controls. Removing a conversation from the visible history marks its stored record deleted; it does not immediately erase it. For erasure of hosted conversations, memories, and account data, follow the Privacy Policy and contact our legal team.
Encryption & credentials
Protected on the way out, protected at rest, and your keys kept sealed.
The parts of Cuttlefish that do reach the network are protected in transit and at rest — and the most sensitive thing you hold, your provider keys, are kept in your own keychain or encrypted in our credential service, never handed to a model.
Encrypted in transit
Requests to hosted services, cloud models, and remote connected systems use protected connections. A model running on the same computer performs inference there; a model on your network or in a private cloud receives requests at that endpoint. Hosted account history and memories remain separate from where inference runs.
Encrypted at rest
The hosted parts of Cuttlefish — what a team shares and what follows your sign-in — are stored encrypted on the server side. On your own computer, your data sits under your operating system's protections like any of your other files. Backups you save are yours to store wherever you keep them.
Your keys, sealed
Credentials for compatible on-device connections use the device’s protected storage. Cloud-provider credentials are sent over a protected connection and held encrypted for authorized requests. Removing a connection removes its active stored credential; retained backups and provider-side credentials follow their own policies. Revoke a provider key with that provider if you need to end its use outside Cuttlefish.
Isolation
Your account, your team, your data — kept separate.
One person's workspace is never blended with another's. The same holds when a whole company runs Cuttlefish: each organization's work is fenced off from every other, and people only reach what they've been given.
One workspace, yours alone
Your conversations, memory, settings, and built apps belong to your workspace and no one else's. Nothing you do leaks into another person's Cuttlefish, and you're never quietly sharing a space you didn't choose to share.
Companies stay fenced off
When organizations run Cuttlefish, each one's data, connected systems, and shared work are isolated from every other organization. Inside a team, people are invited to a specific piece of work with clear limits on who can see and do what — and admins can see what was done, by whom, and where results went.
Sessions you can end
Signed in on more than one device? You can see your active sessions and end any of them in a couple of clicks. And a single, clearly labeled control pulls back every allowed action at once when you want a clean slate — useful the moment something feels off.
Review governed actions
You never have to take Cuttlefish's word for it.
For anything Cuttlefish does — a sent message, an edited file, a tool it ran, a task that finished while you were away — you can open a plain record and read it in seconds.
It happens
A record is created automatically.
You don't enable it or maintain it — proof is simply part of how Cuttlefish works.
What it didWhat it usedWho approved it
It's confirmed
Genuine and unchanged since.
If anything had been altered after the fact, you'd know — and that check runs by itself.
Tamper-evidentHonest trail
You read it
Plain by default, deep on request.
It reads in everyday language; the full technical detail waits behind an optional view.
What changedWhere it went
Everywhere
It reaches wherever Cuttlefish acts.
Governed actions can be reviewed through their available records and supporting evidence, whether initiated from a conversation, browser, connected system, or paired phone.
One historyBeside each result
Sensitive details are summarized or masked before anything leaves your device — you see enough to trust the work and nothing that shouldn't be shown. The full security model is in the security model.
Published architecture boundary
Trust claims map to specific system responsibilities.
Cuttlefish keeps organization controls separate from model choice and connected systems. The technical overview explains the customer-visible boundaries: independent assistants, approved access, saved work, action review, and the scope of signed evidence.
Owned by Cuttlefish
Cuttlefish retains authorized work, saved history, approvals, and results so users and organizations can review and continue their work independently of a model provider.
Bounded dependencies
Models contribute cognition and enterprise systems perform external work through scoped connectors. Their sessions, service behavior, and external records remain separate dependencies.
Receipts have a precise scope
An Ed25519-verified governance receipt protects the integrity and attribution of its captured record. Claims about an external outcome depend on the source and outcome evidence linked to that receipt.
Honest by default
What we do — and do not — claim.
Trust starts with telling you the truth about what's real today. Here's the straight version.
What we claim, and stand behind
Your organization chooses allowed model routes and system access. On-device inference remains separate from hosted account history and memories. Credentials are protected in the relevant device or hosted store. Organization policy and existing grants govern actions; additional approval is requested when required. Signed governance records support review of the recorded action and its associated evidence.
What we don't claim
We don't claim a specific third-party compliance certification on this page, and we won't imply one we can't show you. If your review needs the current state of certifications, audits, or a specific regulatory posture, ask us directly and we'll tell you exactly where things stand — no overstatement.
For a formal review
Security and procurement teams can request the materials they need — security details, data-processing terms, and the subprocessor list — and walk through deployment options with us. Start with the security model, data processing, and subprocessors, then reach out for anything specific to your environment.
Talk to us
Bring your reviewers. We'll bring the details.
Request a security review and we'll line up the documents, walk your team through the controls, and answer the hard questions plainly.