Security
Last updated: August 3, 2026
Report vulnerabilities to contact@zodagent.com. For general security inquiries: contact@zodagent.com.
Local-first architecture
Zod Agent is a client-side application. There is no backend, no account, and no server that stores your data. Sessions, memory, todos, notes, data stores, provider configuration, and preferences are persisted in your browser's localStorage (and mirrored to IndexedDB for the background scheduler). Closing the tab or the browser never sends your data anywhere.
Your data
- All workspace data lives on your device and stays on your device.
- We do not collect, store, or process your conversations, memory, or configuration.
- You can export the entire workspace state as JSON from Settings → General → Export data, and restore it with Import data.
- Clearing your browser storage (or removing the extension / app data) removes your workspace.
API keys and credentials
Provider API keys are stored only in your browser's localStorage. They are sent only to the provider baseUrl you configured in Settings → Providers. The settings UI masks secret keys by default and only reveals them when you explicitly toggle "show API keys".
Requests to providers
The only network requests Zod Agent makes are the LLM requests you explicitly trigger, sent directly from your browser to the provider endpoints you configure (for example OpenRouter, OpenAI, Groq, or a local server like Ollama or LM Studio). We do not proxy, log, or inspect your requests. Note that whatever you send to a provider is subject to that provider's own terms and policies.
Extension and desktop permissions
The Chrome extension and desktop app can act on your browser tabs and your desktop. These capabilities are opt-in: the extension requests host permissions for the providers you use, and the desktop app only controls what you grant it. There is no remote code and no CSP exceptions — the entire app is static HTML, CSS, and JavaScript that runs locally.
Vulnerability disclosures
Submit vulnerabilities to contact@zodagent.com. Acknowledged within 5 business days. Critical incidents communicated via email.