Privacy

what is indexed, what is stripped, what never leaves

deja indexes credential-bearing histories, so privacy is a first-order concern, not an afterthought.

What gets indexed

The conversation, and what the agent did while having it: the file paths its tool calls named, the commands it ran, the spans its edits replaced, and what its tools printed. That last part is why redaction matters — command output carries far more credentials than prose does — and every one of these paths goes through the same redaction pass as the conversation itself. Replaced spans are source code from your own files; they are stored so deja restore can hand work back, and they stay on the machine like everything else.

Local by default

Indexing and search have no network path. The index and its usage sidecar never leave the machine. Network access happens only when you run deja update, deja sync ssh, or the doctor version check (which --offline disables).

Redaction

Secrets are stripped at index time — API keys, JWTs, PEM/PGP private-key blocks, bearer and HTTP Basic auth, provider tokens, scheme://user:pass@host URLs, and (since 0.14.2) bare high-entropy values in secret-shaped positions: the value side of any assignment or a token alone on its own line — before anything is written. Redaction runs on the full message before any size cap, so a secret straddling the cap boundary can't slip through. Redacted output is what search, MCP recall, share and sync all serve.

Control what's kept

  • Exclude — ~/.config/deja/exclude patterns or DEJA_EXCLUDE_PROJECTS skip projects at index time, and sync export honours them too, so a project excluded later does not leave the machine. Sessions indexed before the pattern existed stay searchable locally until deja index --rebuild; deja index tells you when that is the case.
  • Forget — deja forget removes sessions and records a tombstone so they don't come back on the next index; --dry-run to preview, --list to see the tombstones, --unforget <id> to reverse one.
  • Redaction report — deja stats --redaction shows what was masked, per rule and harness.
  • Audit what agents received — deja log lists recent recalls and injections; deja log --last prints the exact digest most recently served.
  • Trust scopes — ~/.config/deja/policy.json controls what memory activates where. Per activation path (search, mcp, auto) you allow or deny origins: local, imported (anything synced from another machine), or a single peer like imported:mini. Example — synced sessions stay searchable but never auto-inject: {"activations":{"auto":{"imported":false}}}. DEJA_AUTORECALL_LOCAL_ONLY=1 remains an alias for exactly that rule. Receipts and deja log --last name the policy that allowed each injection. deja embed is the one command that sends session text off the machine, and no activation describes that, so it takes the agreement of all three: anything a rule withholds on any path is not embedded, and deja embed reports how many records stayed.

Full details in the security model.