Your data
Security
No data is sent to Critias. What is stored locally, what reaches the model provider, how credentials are kept, and how to report a vulnerability.
No data is sent to Critias. It is a local application: there is no Critias server and no Critias account.
What is stored locally
Your original files, the DuckDB database, the analyst's scripts and their output, sealed figures, conversation history and your confirmed business context. Uploaded files are never modified.
What reaches the model provider
Your question, the context you confirmed, column profiles, rows the data checks flagged, and the printed output of the scripts the analyst runs. These go to the provider and model you configure, under that provider's terms. Critias does not switch provider or model on its own.
Credentials
Your API key lives in a local .env file, which the repository's ignore rules keep out of Git. Critias sends it only to the model provider you configured.
Reporting a vulnerability
Please do not open a public issue. Report it privately on GitHub or email hello@critias.ai with "Security" in the subject. I aim to reply within five working days. The security.txt has the same details.
Supported versions
Only the latest release receives security fixes.
Last updated