Security

Last updated: August 2026

Encryption

  • In transit: all traffic to GWC services runs over TLS with a modern certificate chain.
  • At rest: provider credentials, OAuth tokens, and credentials retained solely for historical settlement are encrypted with AES-256-GCM. Conversation and workspace data is stored on GWC's own servers under authenticated per-account access control; it is not separately encrypted at the application layer.
  • On your machine: GWC Studio binds its local master keys to the operating system's keystore (e.g. Windows DPAPI) rather than storing them as files.

Your API Keys (BYOK)

  • Bring-Your-Own-Key keys are never stored on GWC servers — not even encrypted. They stay on your device and are used in memory per request to route the call, then discarded. They are never persisted or logged.

Agent Execution Safety

  • Every disruptive action an AI agent attempts (shell commands, file writes) passes a policy engine and approval gate before it runs.
  • Agents can run inside a sandbox — /sandbox restrict (WSL) or /sandbox full (container), set per conversation or per tool call. The default is none: commands run on the host, under the approval gate above.
  • Agent roles run under least-privilege tool envelopes — a reviewing role structurally cannot modify what it reviews; a measuring role structurally cannot alter what it measures.

Your Data

  • We never use your code or conversations to train AI models.
  • We don't sell or share your data with third parties.
  • See our Privacy Policy for full detail on where data is processed.

Certifications

  • GWC does not currently hold SOC 2 or ISO 27001 certification. We state this plainly rather than implying otherwise; the controls above are real and verifiable in the product.
  • Security questions: [email protected]