Security

Folder limits, approval mode, secret redaction and the pause switch are enforced by the Pairon runner on each computer. A compromised Pairon server can send requests. It cannot grant those permissions.

Source: architecture decision record 0002, “The runner, not the server, enforces what agents may do on a computer,” accepted 16 September 2026. This page restates that record and the runner’s published data table. It is not a certification, a pentest, or a promise that every secret will be caught.

• Stored. Chat, instructions, agent reply text and tool names.
• Relay only. File contents and terminal output. A diff is relayed, and the stored event keeps the path plus lines added and removed, not the file contents.
• Guests. A session guest sees the transcript and change summaries. They do not see live file contents or terminal output unless the computer owner shares them.
• Secret values. Common secret formats are masked on the runner before chat, replies, diffs, terminal output or file views leave the computer. Custom secrets outside .env files and known key formats may not be caught.

Raising a lane to full access, adding an allowed folder, or letting teammates edit the working copy cannot be a plain click in the browser. The runner checks a local prompt or the owner’s passkey. Policy lives on that computer. The product UI shows what the runner reports.

Some places, such as SSH keys and system folders, are never opened to agents. The owner’s own tools, such as git, can still use them. Sensitive actions include commands outside the allowed folders and sending data over the network. Under approval required, those wait for the computer owner or an admin. The author of an instruction cannot approve them on someone else’s computer.

Recovery snapshots, the code graph and memory upload are off by default. Each one needs the project setting turned on and a local consent from the computer owner. The runner refuses the upload while that flag is off. Optional memory keeps its body on the runner machine. Leave it off until the workspace owner has opted in.

The machine credential never leaves the computer. Its private key uses the operating system keychain when one is available. Headless computers fall back to a file with owner-only permissions, which is weaker protection.

The beta request form sends your email, your confirmation that you are at least 18, the privacy notice version, and the server time when you agree. It does not ask for your name or free-text answers. Optional site analytics uses first-party browser storage only after you allow it, and stays off when Do Not Track or Global Privacy Control is enabled. It can send page paths, fixed interaction labels, campaign fields, referring site hostname and a random tab visit id. Details are in the privacy notice.

Questions about a computer you have connected can go to contact@pairon.dev.