Security

On your machine

Recordings live in a local cache under ~/.hyp. With Claude Code attached, raw request and response bodies pass through a spool directory that only your user can read (mode 0700). HypAware reads each file for the few fields it needs and deletes it. The spool is capped at 512 MB by default. Every local listener (the gateway, the OpenTelemetry listener, the client listeners) binds to loopback only.

A connected machine holds two credentials, each in a file only your user can read (mode 0600). The forward credential lets the daemon send rows to your organization, pull the organization’s managed configuration, and renew itself. It cannot read data. It lasts 21 days by default and renews automatically. The query credential lets you read your organization’s data from the CLI. Its refresh token lasts 30 days, and access tokens last one hour.

hyp leave deletes the forward credential from the machine. It does not revoke it on the server, and there is no hyp remote logout command. If a machine is lost, ask us to revoke its credential. Removing a member from the organization revokes that member’s sign-in sessions.

Proxy mode and the local certificate authority

Proxy mode routes all of an AI client’s HTTPS traffic through the local gateway. To read AI provider traffic, HypAware generates a certificate authority on your machine. The CA is name-constrained to api.anthropic.com, api.openai.com, and chatgpt.com, and excludes all IP addresses, so it cannot vouch for any other host. The private key is readable only by your user. The CA is valid for ten years. Which of the three hosts is decrypted depends on which clients you attached: Claude Code alone means api.anthropic.com; adding Codex adds the two OpenAI hosts.

No current release installs the CA into an operating system trust store. Earlier releases on macOS did install it into the login keychain and left a login item that sets NODE_USE_SYSTEM_CA. If you ran one of those releases, that trust is still on your account. hyp status shows the CA fingerprint, the hosts it covers, whether the keychain still trusts it, and whether the login variable is set. hyp client detach claude --purge and hyp daemon uninstall remove all of it.

When installed globally through npm, the daemon checks the npm registry about once a day and installs new versions of the hypaware package by itself. It is a version check against the registry, not an upload of anything you recorded. It is also a remote code update channel, so we say so here. An organization’s managed configuration can also set the flag. Set auto_update to false to turn it off and update by hand.

HypAware does not scan for or redact secrets automatically, on your machine or on the server. The hypaware-privacy skill is a manual review you run before syncing. It samples recordings inside your coding agent, so those samples go to your agent’s model provider. What you sync is stored as it was recorded.

On AI providers HypAware does not fully support, the gateway stores only what it can decode and drops the rest with a warning. HypAware may record less than the full session on those paths, never more.

HypAware Cloud

HypAware Cloud is one server process on a single virtual machine in Amazon Web Services, Oregon (us-west-2), with one data volume, fronted by Amazon CloudFront. All organizations share the machine. Each organization’s data is kept in its own partitions on the volume. The server can archive to Amazon S3 with a separate storage role per organization; that path is built but not in use today, so no customer data is in S3.

Connections from your machine and your browser use TLS, which terminates at Amazon CloudFront with a minimum of TLS 1.2 (the AWS 2021 security policy). The connection from CloudFront to the application host is plain HTTP inside the AWS network today, not TLS. Outbound calls to Anthropic and AWS use HTTPS.

The server takes the organization from the verified credential on every request, never from anything the client sends. A request for another organization’s data is refused unless the caller is a Hyperparam operator. Separation between organizations is by partition on one volume, enforced in the server, not by separate accounts or storage credentials.

Sign-in uses OpenID Connect with PKCE through Google. We store no passwords. Multi-factor authentication for your account is whatever your Google account enforces. The dashboard session is an HttpOnly, Secure, SameSite=Lax cookie that lasts up to 90 days and expires after 30 days without use. Access tokens last one hour and are held in memory, never in browser storage. Organization read tokens last up to 90 days and can be revoked. Join tokens for unattended machines default to one year and can be minted for up to ten.

There are three roles: member, publisher, and admin. Roles control who can manage members and tokens. They do not limit reading. Every member can read every other member’s synced sessions in full, search them, and read every published report. If that does not fit your team, use the folder controls on each machine to keep work local.

Hyperparam operators can read and administer every organization: sessions, search, reports and drafts, members, machines, tokens, and managed configuration. Operator standing is an allowlist of named staff plus one administrative token held on the server. Two staff have shell access to the server; three hold operator standing in the dashboard. Access is granted and removed by hand, and removal is part of offboarding. Operators read customer data for four purposes: reviewing and publishing your reports, support you asked for, security and abuse investigation, and keeping the service running. We do not copy customer data to laptops, personal AI accounts, or test environments; test fixtures are synthetic and development runs against our own staff’s sessions.

Operator reads through query and search are recorded in an audit trail kept with the organization’s data. Views of reports and drafts, and listing views in the admin surface, are not audited. Your organization cannot see its audit trail today. Anyone with shell access to the server can read data without an audit record, and the audit records sit on the same volume.

Reports are generated on the server with Anthropic’s API, called directly under Anthropic’s standard commercial terms through Hyperparam’s own account. The model queries your organization’s sessions, and the query results go to Anthropic unredacted, up to 200 rows per query. Requests use a one-hour prompt cache on Anthropic’s side. Anthropic’s commercial terms exclude training on API inputs and outputs. One API key serves all organizations, and there is no per-organization opt-out today. Generated reports are drafts until a Hyperparam operator reviews and publishes them. The full transcript of each generation run is stored with your organization’s data and is readable by operators only. Published reports are served under a content security policy that blocks scripts.

Server logs do not contain session content, prompts, query text, search patterns, IP addresses, or user agents. They do contain organization names, session and machine IDs, and the email address of any sign-in that was refused.

The data volume is snapshotted daily and each snapshot is kept for 14 days. A restore from snapshot has not yet been rehearsed.

Synced data has no expiry. There is no tool today to delete an organization’s synced sessions or a whole organization; deletion is done by hand on the server on request or when an organization leaves, within 30 days, and snapshots expire 14 days after that. Product telemetry expires after 30 days.

The dashboard loads no third-party scripts, analytics, or fonts. It sets no cookies of its own and keeps one local storage entry, a timestamp of the last report you saw.

Our AWS account and detection

The root account has multi-factor authentication and no access keys. CloudTrail is on across all regions with log validation, GuardDuty is enabled in the regions we use, and buckets that hold anything sensitive block public access. Production shares one AWS account with our website and other projects; it does not have a dedicated account. Dependabot alerts, secret scanning, and push protection are on for every product repository.

Incident response

Hyperparam’s founder is the responsible person for security incidents. If we confirm a breach affecting your data, we will notify your organization’s admins by email without undue delay and no later than 72 hours after confirmation, with what we know at the time and updates as we learn more.

Report a vulnerability

Write to legal@hyperparam.app. Tell us what you found and how to reproduce it. We will reply and keep you posted on the fix.