Privacy
Default checks run locally; optional features can reach services.
No Replume account or API key is needed for the default path. Replume writes a local .replume/ directory: config, task contract and optional scenarios; an events ledger, baseline and reports. The ledger and reports are git-ignored by init. They can contain task text, paths, tool input (including text supplied to a Write tool), redacted command summaries and test evidence. Secret redaction is pattern-based, not a guarantee. Treat them as local project data, not tamper-proof records.
What can leave the machine?
| Action | Destination and data |
|---|---|
| Default Replume hooks and verify (published 0.2.1) | No Replume-managed outbound request. Your own test commands may use network. That published package has no model review and does not start a second agent CLI. |
| Web runtime image preparation | With auto.runtime: web, Docker/npm registries receive image and package requests; repository code is not sent by that preparation. |
| Optional model judge | The configured provider receives task/action context when enabled. Review its settings before turning it on. |
replume verify --check-registry | npm or PyPI receives package names from dependency changes. |
replume verify --legacy-judge --post-github-comment | Task text and model reasoning are posted to the GitHub PR (public when the repository is public). --post-github-comment requires --legacy-judge, which also sends the full diff, task text and action summary to OpenAI. |
| Model review at done (0.2.2 candidate, not in published 0.2.1) | On by default in auto mode. At a Stop that is allowed to finish, the task text, the diff against the task start, and the test output Replume ran go to a second agent CLI that is already installed and signed in. Codex is started with -s read-only in an empty temporary directory. Claude Code is started with --safe-mode and an empty tool list, with no saved session. That CLI sends the prompt to its own vendor under your login (OpenAI for Codex, Anthropic for Claude Code). Replume does not send it to a Replume server. Pattern redaction runs first and is best effort. |
replume share (published 0.2.1 and the 0.2.2 candidate) | Opt-in. Prints the exact body, then uploads one session report to replume.dev only after you confirm. The link is unlisted. It does not run during hooks or verify. |
replume github comment (published 0.2.1 and the 0.2.2 candidate) | Opt-in and separate from --legacy-judge. Prints the exact Markdown, then posts redacted allow-listed sections of one saved report to a GitHub pull request through logged-in gh or GITHUB_TOKEN. It does not call OpenAI and it does not run during verify. A public repository makes the comment public. The comment says it is a saved report, not a fresh verify. |
Model review in the 0.2.2 candidate
The rows above stay. This section is only the candidate. Published 0.2.1 sends nothing for a model review, because that package does not have one. In the 0.2.2 candidate, auto mode starts the review when the finish is allowed. Turn it off with either of these; both leave the local checks and the report in place, and the report says the review was turned off:
review:
enabled: falseOr set REPLUME_REVIEW=off in the environment that launches the agent. review.cli can be auto, claude, or codex. With auto, a Claude Code task asks Codex when Codex is installed. The old verify --legacy-judge path is unchanged: it is off unless you pass the flag, and it still sends the full diff, task text, and action summary to OpenAI. --post-github-comment still requires that flag. replume github comment is the newer opt-in and does not use the legacy judge.
This website
The replume.dev marketing and docs pages use PostHog (US) for anonymous product analytics: page views, clicks on install, copy and call-booking buttons, and session recordings with form fields masked. It does not record what you type into forms, and it is not part of the Replume CLI: the CLI sends nothing to PostHog. Shared report pages (/r/...) do not load analytics. Do Not Track is respected.
Isolation is not absolute
Docker scenario runs use a container without external network access. When Docker is unavailable, auto isolation falls back to an isolated Git working copy on your machine. That is not a security sandbox: run only trusted repositories. Replume cannot guarantee that every agent action was captured if hooks are disabled or unsupported.