Security
Security & vault
The encrypted credential vault, your keys staying yours, and zero telemetry.
Control is the whole premise. Your provider keys, your credentials, and your data stay on your machine — encrypted at rest, never proxied, never phoned home.
The encrypted vault
Secrets — provider API keys, tokens, credentials for remote stores — live in an encrypted vault, never in plaintext config or memory files. The vault is the single source of truth for anything sensitive.
- Encrypted at rest — nothing sensitive sits in a
.md,.env, or config file. - One source of truth — credentials are read from the vault, not scattered.
- Scoped access — a session reaches a secret only when its permissions allow.
[!NOTE] The vault is the only place for sensitive data. Anvil is built so a secret never has to live anywhere else.
Your keys, your providers
When Anvil talks to a provider, it uses your credentials, directly. Nothing is routed through a Culpur server — the request goes from your machine to the provider. Add keys with anvil login or /login, and switch providers live.
Zero telemetry
Anvil makes zero telemetry calls. It doesn't report your prompts, your usage, or your behaviour anywhere. What happens on your machine stays on your machine.
Credential containment
When the agent runs code or commands, it runs sandboxed: writes are confined to the workspace, secret-shaped environment variables are scrubbed, and reads of your credential home are denied — so a task can't exfiltrate a key even by accident.
[!NOTE] Account security — passkeys, sessions, and devices — is managed from your account settings in the command centre.
Related
- Getting started — adding your first provider key.
- Knowledge base — where remote-source credentials are stored (the vault).