Security

How Letco protects your code and data.

A plain-language overview of where your code lives, what Letco stores, how it's encrypted, and who can see what — no buzzwords, just the actual model.

Your code & data

Where your code lives

Your source code is never stored on Letco servers. It lives on your own machines, where the local agent runs the AI — or, for cloud sessions, in an isolated sandbox that is destroyed when the session ends. Letco's database stores project names, paths and metadata, not your repository.

What Letco stores — encrypted

Conversations, plans and pipeline outputs are stored encrypted with AES-256-GCM. Your password derives a key-encryption key using Argon2id; it wraps a random data key, and each session gets its own key on top. A 24-word recovery phrase (BIP39) is the only way to restore access if you lose your password. Usage counts and telemetry are stored without encryption — they contain no content.

Who can decrypt what

Decryption happens on Letco servers while you are actively signed in: your keys are held in server memory for a limited time and never written to disk unwrapped. After you log out or your session expires, the server holds only encrypted data it cannot read. This is per-user encryption at rest with strict key isolation — not client-side end-to-end encryption, and we don't claim otherwise.

Access & identity

Your AI subscriptions, your credentials

Letco runs on the AI subscriptions you already own. Claude Code uses your own local login on your device — that credential never touches Letco. Keys you add for other providers are stored AES-256-GCM encrypted, injected only into your running sessions and never returned by the API. Prompts and code context travel directly from where the session runs to the AI provider — Letco does not proxy them.

The device agent

The local agent authenticates with a revocable per-device token. Messaging runs over NATS with per-device scoped subjects, so a device can only ever see its own traffic. The agent's identity key is stored on disk encrypted with a key derived from the device token, and a compromised device can be revoked centrally at any time.

Layered authentication

Short-lived user tokens with refresh rotation, per-device tokens with hashed lookup and central revocation, RS256 OIDC for tunnel authentication, and NATS auth callout issuing per-device scoped permissions — each layer is enforced independently.

Isolation & deployment

Isolated cloud sessions

Each cloud session runs in its own Kubernetes pod with user-namespace isolation and no privileged access. Outbound network is default-deny: only AI providers, git hosting and package registries are reachable, while internal networks and cloud metadata endpoints are explicitly blocked.

On-premise deployment

For teams with strict requirements, the whole platform can run on-premise in your own infrastructure. Sessions, stored content and encryption keys then never leave your environment — everything stays fully under your control.

Operations & compliance

Transcript export & backup

Every AI session transcript can be exported individually, and all your conversation transcripts with the LLM can be backed up at once — including scheduled, recurring backups to your own S3 bucket. Your work is never locked in — your data stays portable and under your control.

Data lifecycle & audit

Security events are logged and auditable. Deleting your account force-completes active sessions and cascades deletion across your data, revoked sandbox data is removed after a fixed retention window, and voice audio is never persisted. Project history can be erased on request.

Certification — in progress

We are working toward independent security certification, including ISO 27001 and a SOC 2 audit. Our controls are built with these frameworks in mind, and we'll publish attestations here as they are completed.

Found a vulnerability, or running an enterprise security review?