On this page
Privacy and permissions
AII OS has local storage and host-enforced boundaries, but “everything stays local” is not a safe blanket description. Configuration, installed plugins, selected providers, browser behavior and the task all affect data movement. This page identifies traced routes; it is not a complete egress audit or a provider-retention promise.
Concept diagram — same-host versus remote model requests, not a complete network audit. A locally addressed server can itself forward requests; check its configuration.
Controls belong to the human; requests remain requests
Use Settings → Sandbox for directory reach, Settings → Tools for tool switches, Settings → Speech for speech choices, and the Plugins page for plugin-specific grants. These are separate controls. Enabling a tool does not grant every folder; granting a folder does not connect an account; choosing a mode does not itself grant browser microphone permission.
Sources: Settings sections; sandbox-controls; plugin-grants-ui; browser-capture-request
The plugin card exposes declared capability checkboxes, read only, and Save grants. Outbound hosts and credential handles can be granted through a key or account selection on the card, or operator configuration. Local-network scopes are configured in the configuration file; do not look for an invented “allow all network” switch. The configuration updater explicitly distinguishes these fields from the grants the page sets.
Sources: plugin-grants-ui; grant-application
Protect the smallest practical scope. Review an account's intended service and host before consenting. A declared capability is a ceiling on what the plugin may request, not evidence of your consent. A confirmation-required operation is also distinct from standing grants.
Sources: network-admission; operation-admission
Files and protected state
Identity file tools operate within home and granted roots while checking substrate restrictions. Protected names include the ledger, private key, database, operator configuration and provider registry. Sandbox UI text explicitly says substrate protection remains inside every granted root. That does not mean all execution is containerized: the shell source and UI warn that in-process checks are best-effort. Do not extend that check into a claim about every subprocess on every platform.
Sources: protected-names; sandbox-controls; file-and-shell-admission
A file read can return text to the identity's model context. A locally executed read is not a promise that subsequent model requests are local: reasoning uses the configured model/provider, whose complete request flow is outside this trace. Review that configuration and the task before sharing sensitive material. A built-in web fetch is another outbound route: it makes an HTTP GET through host egress checks. Neither route should be assumed to be plugin broker traffic. web-fetch Do not paste keys into a conversation to solve a connection problem.
Meaning search has its own destination
The conversation model does not determine where embeddings run. With provider embeddings, stored memory text and search cues can go to that endpoint. A local plugin is a separate option. Turning the meaning layer off does not stop other model traffic or delete data already sent. See the meaning-layer controls and caveats.
Audio has several routes
The browser requests microphone access, converts captured samples and sends audio to the AII OS host. With a resident voice engine it uses the session lane; the utterance path buffers audio and submits a frame. The page's teardown stops its media tracks. These are source paths, not observations of this browser's permission state or of a successful stop on a particular device.
Sources: browser-capture-request; capture-and-stop; utterance-to-host
For endpoint transcription, the host packages PCM as audio and sends it to the configured speech service. For endpoint synthesis, reply text is placed into a provider request and audio is returned for playback. Endpoints may be local or remote; the presence of an HTTP API does not settle location or retention. Browser speech synthesis is another path, whose implementation and privacy depend on the browser and operating system.
Sources: transcription-request; synthesis-request; browser-speech
Saving speech configuration can itself contact a service: the source checks input using silence and output using “Ready.” Changing settings is therefore not necessarily a network-free action. We did not run these checks for this draft.
Sources: speech-save-checks
Who is heard controls ordinary transcript delivery using stable speaker identifiers rather than display names. It is not a microphone-capture or deletion control: on the resident-engine path, the host can retain withheld final text as recent context available to the identity through explicit recall source=heard. Identification does not grant authority. Treat Meeting as potentially recording room words; obtain participants' consent. Off is not deletion of earlier audio, transcripts or history.
Sources: speech-settings; transcript-dispatch
Platform services: known defaults and unknown details
A local model does not mean offline startup or founding. The shipped template names the founding and witness defaults below; saved configuration can differ. The certificate server has a separate default in application configuration. These are source-derived destinations, not a maintainer-verified complete network or privacy-policy inventory. In particular, a hostname does not establish the recipients behind it, all request fields, or retention.
Diagram — the shipped default destinations.
For every one of these routes, three things remain unestablished: the recipients behind the hostname, the complete set of request fields, and the service's retention or deletion policy. Exact contact timing also needs a separate trace — do not assume selecting a local model prevents startup contact.
Default evidence: shipped founding/witness template and configuration areas. A maintainer-verified destination/purpose/data/trigger/retention inventory and authoritative service policies are still required for full privacy acceptance. Model, speech, plugin, update and download routes are additional categories, not covered by this platform-only table. Where required disclosure is missing for your intended data, stop before the consequential action rather than assume local-only processing or a deletion guarantee.
Known limits
No capture, retention or browser-permission test was performed. Plugin-specific recording storage, complete runtime egress, provider retention and all fallback behavior remain unverified. A full inventory must also inspect configured model requests, deliveries, updates, downloads and each installed plugin. Technical boundaries explains why a plugin's own success message cannot close those questions.
Withheld-context source: retention and withholding/recall notice. No exact retention period or raw-audio deletion guarantee is established here.