Witness privacy

What leaves your machine

Only two kinds of message, and only these fields.

A seal, sent at most about once a minute while you work, and when a session ends:

• your install's public key (the private key never leaves your machine);
• a fingerprint of your record: the hash of its latest line. Each line carries a random value, so the fingerprint cannot be traced back to any command, file or text;
• a count: how many lines your record has;
• a timestamp and a signature made with your key.

A near-miss, only if you turn it on or send one yourself. It carries your public key, one of five words (destructive_command, credential_exposure, unreviewed_push, injection_suspected, other), optionally the hash of the record line it refers to, a timestamp and a signature. No free text, ever.

Never sent: your code, file contents, commands, prompts, file paths, working directory, repository names, tool names or arguments, outputs, hostname, username, git email, which agent you use, or session ids. Automated tests in the code fail if anything else leaves.

The record itself stays in ~/.vigilia/ on your machine. You can read it, verify it and delete it.

What is opt-in

• Using the witness at all. init --offline keeps everything local; nothing is sent.
• Near-misses. Off by default.
• The weekly digest. A feed at your receipt page's address. Subscribing to it is the opt-in; there is no email and no account.

What the witness keeps, and where

• The seals and near-misses it receives, to count them per install and to show you your receipt page.
• Its own hash chain, which lists per entry only a position, a time to the second, and hashes. It says nothing about any install and is public.
• It runs on a server in Geneva, Switzerland, on Infomaniak, with hourly backups to Infomaniak object storage in Switzerland.

Every six hours one combined fingerprint of the witness's whole chain is also mirrored publicly, to the sentinel-hook repository on GitHub and the Sigstore Rekor transparency log, so that no single host, including us, can rewrite the history afterwards. Periodic snapshots to Zenodo are planned and not running yet.

IP addresses. The server sees your IP address because that is how a reply reaches you. It uses it in memory to limit how often one address can call, and never writes it anywhere: not to disk, not to a log. The web server in front of it keeps no access log.

Who can see what

• Anyone: the public chain (positions, times, hashes) and totals across all installs.
• Anyone who has your receipt page address: how many actions your install recorded, how many seals, the date it was first seen, the time of the last seal, and near-miss categories if you reported any. The address is not guessable, but it is not secret once you share it. Search engines are asked not to index it.
• Vigilia, as operator: the seals and near-misses above. Nothing else exists to see.

What we will never do

• Sell any of it.
• Publish anything about one install. What is published is aggregated and anonymised: totals and categories across all installs.
• Ask for, or accept, your code, commands or prompts.

Deleting

npx @vigilia/sentinel-hook uninstall removes the hooks. Your record, key and receipts stay on your machine until you delete ~/.vigilia/ yourself. To have the seals and near-misses from your install removed from the witness's private files, write to the address below with your install id. The public chain cannot be edited without breaking it; it carries nothing that identifies your install.

Who operates it

Operated by Gregorio von Hildebrand, Swiss citizen, pending incorporation of Vigilia as a Swiss association. Vigilia is run by a disclosed autonomous AI system. Contact: gregorio.vonhildebrand@aivigilia.com