What runs whereGrid is a binary on your machine. It reads your repositories, spawns agents and language servers as local processes, and writes cards to a folder you choose. There is no Grid server in the path between you and your code.
COMPONENTWHERE IT RUNSWHAT IT SEES
Grid binaryyour machineyour repos, your cards, your settingsAgentsyour machinethe worktree for their card, nothing elseModel providertheir APIthe prompt and the files the agent chose to sendSync imageyour hardware, or hosted by usciphertext. The key stays with youLicence checkour licence servera signed token, a device id, a plan id
What leaves the machineTwo things, and both are visible. The model provider receives whatever an agent decides to send: the prompt, the files it opened, the diffs it produced. That traffic is between you and the provider under your own API key or subscription; Grid does not proxy it and never sees it. The licence check sends a token and a device id.A third thing leaves only when you press the button: a problem report. Grid assembles it, obfuscates every text run in the screenshot and the replay, shows you the exact message, and then hands it to your own mail client. Grid never transmits it for you, and cancelling discards the recording.
THE SYNC IMAGE CARRIES CARDS, NOT CODECard syncing, team collaboration and the phone app move cards, plans, board state and memory. Diffs are referenced by commit, not copied, so a phone showing "3 cards need you" is not a phone holding your source. Contents are encrypted on your machine with a key you hold: if you ask us to host the image rather than running it yourself, we hold ciphertext and cannot read it.
Agent permissionsEvery agent runs under a policy you set per project and per card. The autonomy dial is the coarse control; underneath it, the individual permissions are explicit.
PERMISSIONDEFAULTNOTES
Write filesworktree onlynever your working checkout, never outside the projectRun commandsdeclared commands onlythe manifest is the allowlist. Anything else asksNetwork accessoffon only for declared hosts, per projectInstall packagesaska lockfile change is always shown before it happensGit pushneverDeliver opens a PR. Nothing is pushed to a protected branchDeleteask, alwaysa rewind exists precisely so deletion is reversible
Worktree isolationEach card gets its own git worktree outside the repository, its own branch, and a recorded base commit. Cards that declare a schema change get their own ephemeral services rather than sharing the project database. Your own checkout is never read and never modified, so an agent cannot stash your uncommitted work.SecretsSeed files such as .env and local certificates are copied into a worktree so the app can boot, and are excluded from anything that leaves the machine: never in a card, never in a plan, never in the audit log. Values matching known secret patterns are redacted in agent transcripts before they are stored.Supply chainReleases are signed and notarised, and a software bill of materials is available on request. Plugins declare their permissions in a manifest, are content-hashed at install, and can be pinned per project. On Fleet, only signed plugins from your own registry are allowed to load.Reporting a vulnerability
DISCLOSUREMail security@gridconsole.dev. We acknowledge within two business days, aim to ship a fix within 30 days, and coordinate disclosure with you at 90. No bug bounty during the alpha, but we will name you in the advisory unless you prefer otherwise.
ComplianceGrid is pre-release software. The self-hosted image exists so organisations that cannot send anything outside their own boundary can run the collaboration layer entirely inside it.