Local-first defaults
Chats, model state, vault documents, embeddings, attachments, and normal inference stay on device unless you configure a cloud provider and choose a cloud route.
Local-first is the product boundary.
Pines is designed so private work stays close by default. Cloud providers, sync, MCP resources, and tools are explicit configuration and consent points.
Keychain-only secrets
API keys, bearer tokens, and OAuth access or refresh tokens belong in Keychain, not SQLite, UserDefaults, CloudKit, logs, or audit payloads.
Explicit cloud context
If local vault or MCP resource context would be sent to a BYOK provider, Pines presents a per-turn approval path so you can send without that context or include it knowingly.
Optional sync
CloudKit sync is opt-in and excludes API keys, model binaries, prompt caches, transient tool state, browser state, and generated embeddings by default.
Tool boundaries
Tools declare permissions, network policy, side-effect level, timeout, and explanation requirements. Private local data tools are scoped through app repositories.
Source details
The repository security notes, app privacy notes, MCP notes, and architecture docs contain the implementation-level boundaries.