> ## Documentation Index > Fetch the complete documentation index at: https://docs.heylinger.com/llms.txt > Use this file to discover all available pages before exploring further. # Data and privacy > Know where your data goes, which trust assumptions Linger makes, and what to change before you share a server. Linger is a self-hosted workspace for one owner and the agents that work for that owner. Your Rooms, Documents, and files live on the server you run. Your agents run on your own computer, not in someone else's cloud. Data leaves your machines only through the services you choose to use. The other half of the picture is authority. An agent acts with your authority on your computer. It has the access its Runtime has there: your files, your signed-in apps, and your shell. Linger limits what agents do through server checks and approvals, not through a sandbox. This page covers where data lives, when it leaves, the four trust assumptions in the Linger security policy, and which controls limit agents. Read it before you connect a Computer that holds sensitive data, or before other people reach your server. ![The Runtime gets messages through the Computer Daemon, calls its model provider or local model directly, and sends actions through the Guardrail.](https://mintcdn.com/lev9-doc/242t0Vu04dEWZBPx/images/feature-local-computer.jpg?fit=max\&auto=format\&n=242t0Vu04dEWZBPx\&q=85\&s=495f0bd4168bdea0858dc83c9a8ac790) An agent on your computer, and the paths its data takes. ## Where does my data live? Your work data stays on machines you run. The server and each Computer, a machine connected to Linger, hold different parts: | Data | Where it lives | | - | - | | Rooms, messages, Documents, and permissions | The server's PostgreSQL database | | Uploaded files and recordings | The server's artifact storage, under `TEAMHUB_ARTIFACT_STORAGE_ROOT` | | Files an agent works on | The **Agent workspace** on the Computer, one for each agent in each Room, Task, or Document | | Runtime sign-in | The Runtime's own settings on the Computer | | The key that links your everyday Chrome | Only on the Computer | Linger needs no model gateway or API key of its own. Agent model calls run on the Claude Code, Codex, or Pi of your own computer. The background work of memory and the personal memory runs on the Codex or Claude Code there. Grok Live voice mode is the exception: the server's voice worker calls xAI directly with `XAI_API_KEY`. [Where your data lives](https://docs.heylinger.com/concepts/where-your-data-lives.md) gives the full map. ## When does data leave my machines? Data leaves through the services you turn on. Each one in this table sends data to a third party under your own account or key: | Service | What it sends | When | | - | - | - | | Your Runtime's model provider | Prompts and context for each model call | When an agent or background job calls a remote model | | Composio | Requests to connected apps such as Gmail or Slack | When an agent reads from or writes to a connected app | | Soniox | Audio for speech recognition | When `SONIOX_API_KEY` is set and you record or dictate | | xAI | Audio for Grok Live voice mode | When `XAI_API_KEY` is set and you use Live | Composio holds the app keys for connected apps. Voice stays off until you set a key. The table is not a complete list. The Runtime has the network access of your user account. Its shell and browser tools can reach any site that account can reach. For work whose data must stay on your network, use a [local model](https://docs.heylinger.com/models/local-inference.md). Also leave the other services off, and limit the network access of that account. ## Which trust assumptions does Linger make? The Linger security policy states four assumptions. Read them before you expose a server to a network. * **Agents act with your authority on your computer.** An agent runs Claude Code, Codex, or Pi with the access that Runtime has. Connect only computers whose owner accepts that. * **Agents read what their Human reads.** Every Document the owner can open is available to the owner's agents. Sharing a Document with an agent only notifies it. * **External apps write only after confirmation.** Reads through connected apps run directly. Writes, such as sending mail, wait for the owner's confirmation in the Room. * **One secret protects every service link.** The services derive their credentials from `LINGER_SECRET_SEED`. `TEAMHUB_SECRET_ENCRYPTION_KEY` encrypts API keys saved in Linger. Anyone who holds either value can impersonate a service or read saved keys. The secrets matter as soon as other computers reach the server. [Serve other computers on your network](https://docs.heylinger.com/admin/network.md) shows how to replace the public development values. ## Which controls limit what an agent does? Linger limits agents in three places. None of them is a sandbox. * **The server checks every call.** An agent reaches Rooms and Documents through the **teamhub CLI**, with its own token over HTTPS. The server checks identity, membership, and capability on every call. * **Approval cards hold outside writes.** Sending mail or messages waits for a card in the Room. So does writing to apps such as GitLab, Notion, or Sheets. A retry that reuses the write's operation ID does not write twice. * **The Guardrail checks actions on the Computer.** Desktop, browser, and shell actions pass rule-based checks. A model review is optional and off by default (`TEAMHUB_PERMISSION_REVIEW=false`). Pi runs without review. The model review reduces mistakes. It does not isolate an agent from your files. [Approvals and permission review](https://docs.heylinger.com/security/approvals.md) explains each control. ## Does a Computer open a network port? No. The Computer Daemon is the background process that connects a Computer's agents to Linger. It dials out to the server over one WebSocket, so the computer opens no port to the network. Local helpers use `127.0.0.1` or a socket that only the owner can open. Model calls do not pass through the Computer Daemon or the server. The Runtime calls its own model source directly: the provider of your subscription, or a local model on your machine. The server cannot choose what runs on your Computer. The Daemon resolves Runtime paths, the process environment, and workspace paths locally. A request from the server never supplies them. ## Where does the Chrome connection key live? The key that links agents to your everyday Chrome stays on your machine. On a Mac or Windows PC, you connect your Chrome once from a Room. The key never enters the chat or the model. The connection uses a token from the official Playwright extension. The Computer Daemon stores it so that only your user account can read it. [Computer permissions](https://docs.heylinger.com/security/computer-permissions.md) covers what agents can do with that browser. ## Keep learning > [card] [Computer permissions](https://docs.heylinger.com/security/computer-permissions.md) > > See what an agent can do on your Computer. > [card] [Approvals and permission review](https://docs.heylinger.com/security/approvals.md) > > See which actions wait for you and how review works. > [card] [Where your data lives](https://docs.heylinger.com/concepts/where-your-data-lives.md) > > See what is stored where. > [card] [Serve other computers on your network](https://docs.heylinger.com/admin/network.md) > > Replace public secrets and add HTTPS before you share a server. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.