NoirCode runs on your machine. The privacy question is which provider you connected, and which parts of the session the server puts into each model request.
Where a prompt goesyou
-> NoirCode client
-> local server
-> provider adapter
-> the model endpoint you configuredThe local server stores the session. The endpoint receives one request: the system instructions, the conversation included for that step, tool definitions, and any file contents or command output the agent already gathered. It does not receive a mount of the repository, other projects, or the local database.
The agent decides what to read by calling tools. read, grep, and glob pull specific files and matches. A search does not attach the rest of the tree. Shell output is included only when a shell call was allowed and run. Web fetch and web search send the query or URL those tools use.
What stays local
These stay on disk unless a tool result copies them into a prompt:
- the session database, config, cache, state, and logs (
noircode debug paths) - files the agent has not read
- environment variables and secrets the agent has not opened
- other projects and other sessions
Compaction rewrites older conversation into a summary stored in the session. That summary is local until a later request includes it.
Permissions are the control on reads and commands. A rule can deny read on *.env, deny git push, or ask before every shell command. If no rule matches, NoirCode asks. The Build agent already asks before reading sensitive environment files. That is an approval gate, not a redaction pass. If you approve a read of a file that contains a key, the file contents go into the tool result and can be sent on the next model call. NoirCode does not scan prompts and replace passwords with [REDACTED].
Policies can forbid a provider, a tool, or an integration for the whole install. They do not prompt. Managed config and a Console workspace policy outrank the project file. Denying every external provider and allowing only a private OpenAI-compatible baseURL is the practical air-gapped shape: point the custom provider at a model host on your network, and do not connect the others.
What the provider retains
NoirCode does not set the provider’s retention. After the HTTP call, storage, abuse review, and training depend on that vendor and on the account you used. A self-hosted OpenAI-compatible endpoint never sees the request leave your network, because the baseURL is yours. An aggregator such as a hosted router adds that service as another party in front of the model.
NoirCode Go applies the workspace privacy settings in the console. Paid endpoints that train on request data are blocked unless you change that, and the default allowed regions are Europe and the United States. That is a property of Go, not a global switch inside the coding agent.
There is no privacy: block with retention_days, prompt_logging, or redact_secrets in noircode.jsonc. Session history is kept locally until you delete it. Uninstall does not remove sessions, config, or state. Server logs can contain operational detail; treat the log directory as sensitive. There is no metadata-only audit product that stores user, cost, and duration while guaranteeing prompt text is absent.
A practical setup
For a personal project, connect the provider you accept and use the default permission prompts.
For a private codebase, deny reads of .env, secrets/**, and credential files; ask before shell; and avoid providers whose terms train on customer content.
For a network that cannot call out, use a custom provider whose baseURL is inside that network, and deny provider.use for everything else.
The model sees the request the server built. The way to shrink that request is to constrain tools and to avoid reading files that should not leave the machine.