Security and privacy
Offsite runs on machines you own and talks to services you already pay for. This page states exactly what that means, including the parts that are not comfortable.
No account
Section titled “No account”There is no sign-up, no user record and no server-side identity. Devices are authorised against your host by pairing with it.
Nothing to breach, because there is nothing stored.
No telemetry
Section titled “No telemetry”No analytics SDK. No crash reporter. We removed the one we had.
Feedback reaches us only when you send it from the app, deliberately, with whatever you chose to write in it.
Your tokens are yours
Section titled “Your tokens are yours”The agent CLIs call Anthropic, OpenAI or xAI directly from your host, under your own subscription and your own credentials. Offsite never sees an API key, never proxies a request, and cannot meter your usage because it is not in the path.
What leaves your machine
Section titled “What leaves your machine”| What | Where | Content |
|---|---|---|
| Session traffic | between your devices, direct or via the relay | encrypted SSH; the relay sees ciphertext only |
| Push notifications | our Firebase function → FCM → Apple | readable text: the session name and the workspace name — see below |
| Update checks | get.offsite.sh, offsite.sh |
version queries and downloads |
| Deploy artefacts | a signed short-lived URL, only when you deploy | the IPA you asked to install, expiring after 48 h |
| Feedback | our feedback endpoint, only when you send it | what you typed |
Your code, your prompts and your agent output are not in that table, because they do not leave your machines.
Notifications are the one readable thing
Section titled “Notifications are the one readable thing”Worth being blunt about, because it is the only place where words describing your work leave your machine.
A push notification is not encrypted end-to-end. It travels from your host to a Firebase function we run, on to Firebase Cloud Messaging and Apple’s push service, and then to your device — and it has to be readable text, or your phone could not display it on the lock screen. What it carries:
- the session name — “api-refactor needs your input”
- the workspace name — “…is waiting for approval in offsite”
- ids for the host, workspace and session, the event type and a timestamp
The session name deserves a second look: agent sessions name themselves, and a good self-chosen name says what the work is. “auth-migration” on a lock screen is a small but real disclosure. If a project’s name is sensitive, rename the card yourself — your name always wins — or turn notifications off for that device.
The agent’s one-line recap stays on your machine today. If it ever moves into the notification, it would be the same class of information as the name: a sentence the agent wrote about your work, readable in transit.
What is not in a push: your prompts, the agent’s output, file contents, diffs, commands, paths. And two things reduce the exposure by default:
- A push is only sent to a device that is not currently connected in the foreground. When the app is open and attached, the same event arrives over your own encrypted connection and never touches Firebase at all.
- Notifications are per device and per event type. Turn them off and nothing goes out — see Notifications.
The function we run logs only a push-token id, a status, a hashed IP and a timestamp; the notification text is not stored on our side. But Google and Apple transport it, and their handling is theirs, not ours.
The relay
Section titled “The relay”Optional, per host, and end-to-end blind: it forwards SSH ciphertext between two outbound connections and holds no key that could decrypt it. Clients pin the host key, so a compromised relay cannot impersonate your host. Worst case is denial of service and connection metadata.
Full detail: The relay.
Your host is not exposed
Section titled “Your host is not exposed”Setting up This Mac does not enable Remote Login, does not open port 22, and does not touch your SSH configuration. Both ends of every path dial outbound.
The sharp edges
Section titled “The sharp edges”An honest list, because pretending these away would be worse:
- YOLO permission mode lets an agent run anything in that workspace without asking. That is the point of it, and it is a real risk. Bound the blast radius: a workspace you can restore, a host user that is not root.
- Computer Use gives a session your host’s screen and input. Off by default, locked per session, and revocable in System Settings — but while it is on, it is real control of a real machine.
- Uploads go to the host, in cleartext on that filesystem, and are not cleaned up automatically.
- Anything an agent reads can influence it. A file, a web page or a repository can contain text aimed at your agent. That is a property of agents, not of Offsite, and Offsite does not filter it.
- The clipboard: Offsite gates terminal-driven clipboard writes (OSC 52) so a session cannot silently overwrite what you are about to paste.
Details
Section titled “Details”- Offsite never writes
~/.tmux.conf, never installs tmux plugins, and never depends on your global tmux state — its sessions run on Offsite-owned sockets with an Offsite-owned config file. - Host state is stored with restrictive permissions under
~/.offsite. - The Agent Bridge is a separately signed helper whose identity the host pins; a binary whose signature changed unexpectedly is refused rather than trusted.
- Deploy artefacts expire after 48 hours and the last 10 jobs are retained.
- The Watch complication and widget are refreshed by a silent push that carries no text at all — it only tells the app to fetch fresh state from your host over your own connection.
- Bootstrapping a remote host asks for that machine’s credentials once, over SSH, in batch mode — no credential is stored on our side, because there is no our side.
- The macOS app and its helpers are signed and notarised by RapidRocket GmbH, which is the name macOS shows you in background-item and permission dialogs.