> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trace.probebrowser.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security & Privacy Architecture

Privacy is a core feature of Trace. We use a **Hybrid Architecture** to balance local security with cloud intelligence.

## 🟢 1. Local-First Execution

By default, Trace runs entirely on your machine.

* **SDK/MCP Server**: Runs as a local Node.js process.
* **Browser Automation**: Uses Puppeteer to control a local Chrome instance.
* **Tools**: All 96 tools (`click`, `get_local_storage`, `read_file`) serve data directly from your hard drive/browser to your Agent.

**This data never touches our cloud.**

* File contents (`trace_read_file`) go straight to Claude/Cursor.
* Cookies and Storage (`trace_get_cookies`) stay local.

## 🔵 2. Cloud Intelligence (Opt-In)

When you use AI Features (like `trace analyze` or `trace_p`), Trace sends specific metadata to the **Trace Inference Engine** (hosted on Azure/OpenAI).

**What is sent:**

* **Context**: Console logs, Network error summaries, and a simplified DOM snapshot.
* **Prompt**: The question you asked (e.g., "Why is this failing?").

**What is NOT sent:**

* **Cookies/Tokens**: We automatically redact common auth headers before transmission.
* **Source Code**: We do not upload your source files unless you explicitly ask the AI to "analyze this file".
* **PII**: You are responsible for not asking the AI to analyze screens containing PII.

## 🔐 Authentication

* **API Key**: Required for Cloud features. Stored locally in your environment variables.
* **Encryption**: All cloud traffic is TLS 1.2+ encrypted.

## 🛡️ Enterprise Mode (Coming Soon)

For strict compliance environments, we will offer:

* **Self-Hosted Engine**: Run the inference layer in your own VPC.
* **Local-Only Mode**: Disable all cloud calls (tools valid, but AI Analysis disabled).