Trust Center
This Trust Center documents the security architecture, data handling practices, compliance posture, and third-party service integrations behind Daharness. It is designed to support enterprise security reviews, vendor risk assessments, and procurement due diligence.
Scope of this document
Read firstDaharness runs on Context Pilot, its open-source engine. Where a control belongs to that engine rather than to the service, this document keeps the name Context Pilot, so that the claim can be checked against the published source and against the paths the software writes on disk.
The controls described here were written for Daharness running on your servers and on the box, where the software runs on hardware you control. Daharness on our servers — the hosted subscription — adds infrastructure that this document does not yet describe, and several statements below do not hold for it.
At a Glance
Quick-reference summary for security review teams and procurement questionnaires. The answers below describe Daharness on your servers and on the box; see the scope note above.
| Question | Answer |
|---|---|
| Does the Context Pilot engine collect user data? | No. The engine has no data collection infrastructure. Not a statement about Daharness on our servers. |
| Does the Context Pilot engine operate cloud servers? | No. All processing occurs on the operator's workstation. Not a statement about Daharness on our servers. |
| Does the Context Pilot engine include telemetry? | No. Zero analytics, tracking, or phone-home mechanisms in the engine. Not a statement about Daharness on our servers. |
| Where is data stored? | Locally, in .context-pilot/ within the project directory. |
| What data leaves my machine? | Only data you explicitly send to your configured LLM/search/OCR providers. |
| Is the source code auditable? | Yes. The Context Pilot engine is fully open-source on GitHub, under the AGPL-3.0. |
| What license? | The Context Pilot engine is under the GNU Affero General Public License v3.0 (strong copyleft, network-use clause). The commercial terms of Daharness itself are not covered by this document. |
| SOC 2 / ISO 27001 certified? | Not applicable (no cloud service). Controls are documented. |
| GDPR compliant? | Compatible by architecture. See Compliance. |
| Can it run air-gapped? | Core features: yes. LLM inference requires API connectivity. |
| Vulnerability reporting? | GitHub Security Advisories |
| Does it use cookies? | No. Zero cookies, tracking pixels, or advertising identifiers. |
Project Statistics
Quantitative indicators of the Context Pilot engine's maturity, engineering rigor, and security posture.
65,000+ Lines
Rust + TypeScript source code across the agent, orchestrator, and web frontend.
760+ Commits
Complete, auditable development history in a public Git repository.
1,001 Lint Rules
980 at forbid level, 21 at deny. No suppressions allowed without hash chain update.
22 Crates
Modular workspace architecture. Each crate has a single responsibility.
12 Protected Files
SHA-256 hash chain prevents unauthorized changes to security-critical configuration.
0 Telemetry Calls
No analytics, tracking, crash reporting, or phone-home mechanisms. Verifiable in source.
Security Posture Summary
The Context Pilot engine operates under a local-first architecture with no cloud infrastructure, no intermediary proxies, and no telemetry collection. The following controls are enforced at the architectural level.
Local-First Execution
All processing occurs on the operator's workstation. No cloud infrastructure exists for data to be transmitted to.
Zero Telemetry
No analytics, usage tracking, crash reporting, or phone-home mechanisms. Network egress is limited to user-configured API providers.
Open Source (AGPL-3.0)
The Context Pilot engine's complete source code is publicly auditable under the AGPL-3.0. Every network call, file operation, and tool invocation is verifiable.
API Key Isolation
Credentials are stored locally and transmitted only to their designated provider endpoint. No cross-provider or intermediary routing occurs.
Documentation
Select a topic below for detailed documentation. Each section is designed to address specific categories commonly required during enterprise security assessments.
Security Architecture
Data flow architecture, encryption practices, integrity controls, access model, and incident response procedures.
Data Privacy
Data classification, storage locations, retention policies, data subject rights, and privacy-by-design controls.
Compliance Framework
Regulatory alignment assessment including GDPR, SOC 2, ISO 27001, and open-source licensing obligations.
Subprocessor Register
Complete inventory of third-party services, data transmitted, opt-in requirements, and provider-specific data processing details.
Contact
For security-related inquiries, vendor risk assessment questionnaires, or to report a vulnerability, please use the appropriate channel below.