Privacy and security
Wazza OS protects your computer by giving agents a computer of their own: the VM. Agents work there freely; what reaches your real computer (your files, your screen) goes through you.
What runs where#
| Where | What runs there | What it can reach |
|---|---|---|
| The VM | The apps (GIMP, Chromium…), the Hermes agent, every agent's commands and file work | The VM's own files and the Internet. Not your computer's files, not your screen. |
| Your computer, inside Wazza OS's sandbox | The agent programs of some Chats (for example Claude Code and Codex), and the Computer Control Chat | Their own folder (bubblewrap and Landlock), the Internet and Wazza OS. Not your other files; not services of your computer unless you turn on Local services. |
| Your computer | The Wazza OS window, the VM's engine, Wazza OS's own services | Its own folders; it never changes your files (what it writes is always new files). |
| The AI provider you chose | The model | What the agent sends it: your messages, and the content the agent reads or looks at to answer (files, pictures of an app). Its own policy applies (your plan's or key's). |
Agents in the VM work without asking#
A Chat's agent runs its commands and edits files in the VM without asking you each time: Wazza OS has no "ask mode". The VM is the protection: what an agent does there cannot touch your own computer's files. For mistakes inside the VM, Wazza OS keeps the versions of files that get overwritten and a checkpoint of every file a Chat edits (Versions and undo), and you can back up a whole VM (Backups).
Where Wazza OS asks you#
Inside the VM, agents never ask: they run commands, install and uninstall apps, write to other tabs' Chats and take steps that cannot be undone (deleting, sending) without a card. When you want to approve something first, say so in your message ("show me the plan before you install anything"). What reaches your own computer is different:
| When | What happens | Who decides |
|---|---|---|
| Files from your computer go into the VM (your paste, an agent's copy) | By your rule in Files & sharing: Allow (default), Ask, or Off. Attaching a file to a Chat is your own pick in a file chooser. | You |
| Files from the VM go to your computer (your paste, an agent's upload) | A question each time by default
(Ask); they land in Downloads/From the VM, never over your files | You |
| An agent wants to see or use your screen | The Computer Control consent card, per tab, and again after every restart | Only your own click on Start |
| A sandboxed Chat on your computer wants to edit your files | Let this Chat edit my files in its model window (with a confirmation); off again at every Wazza OS start | Only you |
| Local services, importing your Chrome profile | Settings switches and buttons that only your own click turns on (an agent can only turn Local services off) | Only you |
Keys and sign-ins#
- API keys, plan sign-ins, custom API tokens and your Wazza OS account are kept on your computer, in Wazza OS's encrypted store.
- Agents in the VM never get the key itself: their requests go through Wazza OS, which adds it.
- The Sign in page shows a key by its last characters only; the command line takes keys on standard input only, never as a word of a command.
- Company folder logins stay on this computer, encrypted; web app sign-ins live in the VM's browser (Sign out of all web apps ends them).
What leaves your computer#
| What | To where | When |
|---|---|---|
| Your messages and what agents read to answer | The AI provider of the Chat's model | When you use a Chat |
| Your skills, files and Chat history | Your Wazza OS account's vault | Only when you connected sync (Chat history can be turned off) |
| Feedback | Wazza, without your account (only Wazza OS's version is added) | When you send feedback |
| Update checks | Wazza OS's download server | At start and every hour (updates are signed and checked before install) |
| Team activity totals (active and idle time, input counts; never content) | Your team's vault | Only on a team account whose policy turns it on |
The app journal (Wazza OS noting the menus, clicks and keys you use in apps, never a password) stays on your computer to teach agents; pause it or delete it in Settings › Skills & learning › App journal. To erase everything: Remove all data.