Privacy

deja indexes credential-bearing histories, so privacy is a first-order concern, not an afterthought.

Local by default

Indexing and search have no network path. The index and its usage sidecar never leave the machine. Network access happens only when you run deja update, deja sync ssh, or the doctor version check (which --offline disables).

Redaction

Secrets are stripped at index time — API keys, JWTs, PEM/PGP private-key blocks, bearer and HTTP Basic auth, provider tokens, scheme://user:pass@host URLs, and (since 0.14.2) bare high-entropy values in secret-shaped positions: the value side of any assignment or a token alone on its own line — before anything is written. Redaction runs on the full message before any size cap, so a secret straddling the cap boundary can't slip through. Redacted output is what search, MCP recall, share and sync all serve.

Control what's kept

  • Exclude at ingest — ~/.config/deja/exclude patterns or DEJA_EXCLUDE_PROJECTS skip projects entirely.
  • Forget — deja forget removes sessions and records a tombstone so they don't come back on the next index; --dry-run to preview, --unforget to reverse.
  • Redaction report — deja stats --redaction shows what was masked, per rule and harness.
  • Audit what agents received — deja log lists recent recalls and injections; deja log --last prints the exact digest most recently served.
  • Trust scopes — ~/.config/deja/policy.json controls what memory activates where. Per activation path (search, mcp, auto) you allow or deny origins: local, imported (anything synced from another machine), or a single peer like imported:mini. Example — synced sessions stay searchable but never auto-inject: {"activations":{"auto":{"imported":false}}}. DEJA_AUTORECALL_LOCAL_ONLY=1 remains an alias for exactly that rule. Receipts and deja log --last name the policy that allowed each injection.

Full details in the security model.