Security
Data and privacy
What an instance stores, for how long, and what leaves it.
This page lists what a self-hosted AgentDock instance stores, for how long, and what it sends elsewhere. It describes the software, not a service: whoever runs the instance operates it and is the data controller for everything in it. The AgentDock project receives nothing from your installation.
No telemetry, no phone-home
The API, the web app and the runner contain no telemetry, analytics, crash reporting or update checks. Nothing reports to the AgentDock project or anyone else.
- The Docker images for the web app set
NEXT_TELEMETRY_DISABLED=1, so Next.js does not report either. If you run the web app from source withnext dev, set it yourself. - Fonts are downloaded at build time and served by your instance, so browsers make no requests to Google Fonts at runtime.
Agent credentials stay on the runners
AgentDock never handles Anthropic or OpenAI API keys and makes no LLM API calls of its own. The Claude Code and Codex CLIs on each agent machine talk to their providers directly, under your own accounts and subscriptions.
Claude, Codex and gh credentials stay on the runner machine. A runtime profile refers to a config directory by path (CLAUDE_CONFIG_DIR, CODEX_HOME); the directory's contents are never sent to the server.
What the instance stores
Everything below lives in the instance's PostgreSQL database on your host.
| Area | What is stored |
|---|---|
| Accounts | Email, name, argon2id password hash, role, status, failed-login counter and lockout time |
| Login sessions | SHA-256 of the session token, created, last-seen and expiry times, IP address and user agent |
| Runners | Hostname, OS, architecture, tool versions, capabilities including the gh username and profile directory paths, an argon2id hash of the runner token and an 8-character prefix |
| Projects | Absolute path of the repository on the runner, owner/repo, branches, the Code Sentinel config snapshot, docs locations, members |
| Fleet | Slots, rounds and checkpoints (headings and summaries agents wrote), pull request numbers, URLs and check state, issue and branch names |
| GitHub issue cache | Titles, labels, assignees, URLs and bodies of issues (up to 64 KB) and pull requests (up to 16 KB) |
| Agent sessions | Session ids, working directory, git branch, session title (up to 500 characters), models and timestamps. Per LLM request: model, token counts, duration, stop reason and API-equivalent cost. Per tool call: the tool name and timing |
| Commands | Each runner command and its arguments, including the full text of messages sent to workers |
| Skill runs | Arguments, the final report (up to 32 KiB of agent output), the list of changed files, the patch (up to 128 KiB of code diff), pull request link |
| Merge approvals | Decision, note (up to 4 KB), who and when |
| Notifications | Titles and bodies. For Telegram: each linked user's chat id and username |
| Webhooks | Outbound delivery payloads (the fixed event envelope), response code and up to 2 KB of response body. Inbound deliveries: delivery id, rendered args, source IP |
| GitHub App | App id and slug, installations and repositories, delivery ids and timing |
| Events | Raw events from runners, the plugin and the server, as JSON |
| Audit | Actor, action, target, before and after values (secrets redacted), result, hash chain |
| Secrets | Telegram bot token, trigger and webhook secrets, GitHub App private key, webhook secret and client secret, all encrypted with APP_ENCRYPTION_KEY |
Cost figures are API-equivalent cost: what the recorded tokens would cost at public API prices. AgentDock does not bill anyone, takes no payments and holds no payment data.
Redis holds only the timers for cron schedules.
What it never stores
- Prompt and response text. Sessions are stored as metadata only. Tool arguments and tool output are not stored, and the OpenTelemetry mapping drops prompts, tool input and output, responses, email and account ids even when
OTEL_LOG_USER_PROMPTS=1is set. - Live pane frames. The live view of a worker's terminal is relayed from the runner to viewers and never written down.
- Terminal attach traffic. Only the attach's duration and byte counts are audited, not the bytes.
- Skill-run output streams, except the final report described above.
- GitHub webhook payload bodies.
- Agent provider credentials, as described above.
Retention
| Data | Kept for |
|---|---|
| Activity feed items | 180 days (ACTIVITY_RETENTION_DAYS) |
| Outbound webhook deliveries and inbound trigger deliveries | 30 days |
| GitHub App deliveries | 14 days |
| Schedule timer jobs in Redis | 24 hours when completed, 7 days when failed |
| Audit records | Never deleted (the table refuses deletes) |
| Login sessions | Until sign-out, revocation, or expiry (7 days idle, 30 days total) |
| Events, LLM requests, agent sessions, issue cache and everything else | No automatic deletion |
Data with no retention job grows until you prune it. Plan your backups and disk accordingly, and see Backups and upgrades.
What leaves the server
Every outbound flow except the runner link is optional and configured by you.
| From | To | When and what |
|---|---|---|
| Runner | Your AgentDock API | Always: the runner's WebSocket |
| Runner | GitHub, through gh with the machine's own login | Issues, pull requests and checks; creating issues; pull requests and pushes for project skill installs |
| Runner | https://skills.sh | Only when someone searches the skills catalogue |
| Runner | https://github.com/<owner>/<repo>.git | Only when someone inspects or installs a skill |
| API | api.github.com | Only with a GitHub App registered: the one-time manifest conversion, then read-only listing of the App, its installations and repositories, and its recent hook deliveries |
| API | api.telegram.org | Only with a bot token set: long polling and messages (plain-text summaries and links; never pane text, prompts, code or secrets) |
| API | URLs an admin chose | Outbound webhooks: the event envelope only. LLM requests, tool calls and pane text cannot be sent |
| Browser | github.com | Only during GitHub App registration |
The agent CLIs on each runner (Claude Code, Codex) send your code and prompts to their providers as part of their normal operation. That traffic is between the CLI and the provider, under your accounts and their terms, and AgentDock does not see or route it.
What reaches the server from outside
- Agent machines need no open port: the runner dials out.
- The runner's OpenTelemetry receiver listens on
127.0.0.1only. - The only paths that must be public are
POST /hooks/github(if you use the GitHub App) andPOST /hooks/<publicId>(if you use inbound triggers). Everything else can stay behind your private network.
Your responsibilities as operator
Because you run the instance, you decide who gets an account, how long data is kept beyond the built-in jobs, where backups go and who can read them. Two things deserve attention:
- Session IP addresses, inbound source IPs and issue bodies can be personal data. If your users or repositories are subject to data protection rules, account for them.
APP_ENCRYPTION_KEYprotects the stored secrets. Keep it out of database backups.