Product·Security

Your code stays
on your hardware.

Agents run local-first on machines you control. Secrets sit in the Keychain, not in our database. Remote control rides an end-to-end encrypted relay (or your own tailnet). Multi-account is config-isolated. Shared links are server-redacted. Transcripts can be crypto-shredded. Audit logs keep a hash-only trail. On BYOK, Continuum is not a markup proxy.

Download for Mac Read the docs

SettingsCodeUsage

security

local-first

code + agents on your hosts

e2e relay

relay sees envelopes, not bytes

keychain

tokens never in plaintext files

audit

hash-only JSONL on the host

your hardware · your keysno markup proxy

01 · Local-first

Compute where the repo already is.

Sessions spawn on a Mac daemon or an enrolled device—your laptop, a Hetzner box, your own cloud account. Continuum orchestrates; it doesn’t become the place your tree lives.

Worktrees, PTYs, and agent CLIs stay on that host. Controllers (phone, web, desktop) send commands; they don’t hold the sandbox.

your hosts your worktrees your CLIs

Code

hosts

this macrepo on disk

hetzner-arm64your account

aws-ec2enrolled

controllers steerhosts execute

Settings

keychain

Keychain · Continuum

claude · primary••••••••••••

claude · work••••••••••••

openrouter · byok••••••••••••

partitioned per instance · not in provider-instances.json

02 · Secrets

Keychain, not a shared secrets file.

Provider tokens and OAuth material live in the OS Keychain (and per-instance partitions for multi-account). Config roots hold non-secret state. The multi-account store intentionally stores no secrets.

Spawn env scrubbing strips inherited credential variables, then re-injects only the pin you chose—fail-closed if the pin can’t resolve. Pair with managed env vars for repo secrets that never leave the host.

03 · E2E relay

The relay can’t read your session.

Paired devices talk through an end-to-end encrypted relay (XChaCha20-Poly1305). The service can see envelope lengths and routing—not prompts, not diffs, not tokens. Prefer zero third parties? Use Tailscale / MagicDNS on your own tailnet.

Non-loopback daemon access is peer-filtered and whois-gated. Every remote write path is rate-limited and audit-logged on the host. See pairing for the account mesh.

iPhone controller

E2E relay · ciphertext only

Mac host decrypt · execute

05 · BYOK honesty

No markup proxy on your keys.

Bring your own subscriptions and API keys. Continuum drives each provider through its own login path. We don’t sit in the middle reselling tokens at a markup. Optional hosted inference is a separate, explicit product line.

Multi-account stays config-isolated—work and personal never share a credential store. Wrong pins fail closed instead of billing the primary by accident. See multi-account.

BYOK Continuum adds $0

your plans · your keys · your hosts

hosted inference optional

only if you choose Continuum models

06 · Questions

The honest fine print.

Short answers here, long answers in the docs.

Does Continuum cloud store my repo?

No. Code and agent sandboxes stay on hosts you enroll. Cloud paths cover account mesh, optional relay, optional hosted inference, and features you opt into (like share links you publish).

Can the relay read prompts?

No. Payloads are end-to-end encrypted. The relay routes ciphertext. For zero third-party transport, put controllers and hosts on Tailscale and prefer that path.

What’s in the audit log?

Hash-oriented records of sensitive actions (sends, model swaps, mobile commands)—not a full transcript dump. Logs rotate by size and age on the host.

Are shared links private?

They’re unlisted with high-entropy IDs and server-side redaction. Anyone with the link can read the published snapshot—treat links like secrets, and shred when you’re done.

Your code stayson your hardware.