Your code stays
on your hardware.

Compute where the repo already is.

Sessions spawn on a Mac daemon or an enrolled device: your laptop, a Hetzner box, your own cloud account. Continuum orchestrates; it doesn’t become the place your tree lives. The local daemon is the trust root by design. Compromising it compromises everything, and compromising any other tier does not.

Worktrees, PTYs, and agent CLIs stay on that host. Controllers (phone, web, desktop) send commands; they don’t hold the sandbox. The daemon’s listener only accepts peers from loopback and the Tailscale CGNAT ranges, every endpoint requires a bearer token, and non-loopback callers are additionally identity-checked against the tailnet, failing closed if that check errors rather than waving the request through.

Provider CLIs are treated as sandboxed children, not as parts of Continuum. Each one owns its own auth state and its own network egress; Continuum does not proxy or inspect their traffic. If you would rather add a second wall, agents run fine inside a container or on a remote box over SSH, and the control surfaces don’t change.

The relay can’t read your session.

Paired devices talk through an end-to-end encrypted relay (XChaCha20-Poly1305). The service can see envelope lengths and routing, not prompts, not diffs, not tokens. It never holds the session key, so “trust us not to look” is not part of the design. Prefer zero third parties? Use Tailscale and MagicDNS on your own tailnet and the relay is out of the path entirely.

Every remote write path is rate-limited on the host: roughly one send per second and one configuration swap per five seconds per session, answered with a structured 429 rather than a silent drop. Every one of them is audit-logged. See pairing for the account mesh.

The agent asks. We check.

Some agents don’t touch the filesystem themselves; they ask the client to read and write on their behalf. Continuum does not obey blindly. The file capability is off by default and is only advertised for a repository you have explicitly trusted. An untrusted repository is told the capability does not exist, and every request is refused.

When it is on, every path is canonicalized before any disk touch: .. segments collapsed and symlinks fully resolved, with the resolved result required to sit under the repository root. That defeats traversal, absolute-path escape, and a symlink planted inside the repo pointing at /etc. The handler then operates on the resolved path it was handed rather than re-resolving the agent’s string, which is what closes the gap between check and use.

Reads are byte-capped so a hostile request cannot pin the host, command policy default-denies privilege escalation and catastrophic patterns like recursive deletes and pipe-to-shell, and each operation is logged with a hash of the path rather than the path itself. If you want the same reasoning applied to the agents themselves, read AI coding agent security and how permission modes work.

No markup proxy on your keys.

Bring your own subscriptions and API keys. Continuum drives each provider through its own login path. We don’t sit in the middle reselling tokens at a markup. Optional hosted inference is a separate, explicit product line, and picking it is a decision you make in the model picker rather than something that happens to you.

Multi-account stays config-isolated: work and personal never share a credential store. Wrong pins fail closed instead of billing the primary by accident. See multi-account.

This is the structural difference from a hosted agent product, where your repository is uploaded to the vendor’s sandbox and the vendor holds the model relationship. Compare with Devin, or with a single-vendor CLI in Continuum vs Codex.