Privacy & data handling

What leaves your network?Your data: nothing.

R-Secure runs on machines you own. This page sets out exactly what it records, where it keeps it, and the one small thing it sends out.

Trace a secret

Follow one .env file through R-Secure.

Pick a step, or let it play. This is what happens when an AI tool opens a file that holds a live key.

Claude Code reads ~/payments-api/.env on the developer's laptop. Its hook passes the event to the R-Secure agent on the same laptop.

Step 01 · LaptopInside your network
Diagram: a developer laptop and your R-Secure server sit inside your network boundary. RAKSYON and the outside internet sit beyond it. The secret value never crosses from the laptop; only an event without the secret travels to your server. YOUR NETWORK OUTSIDE DEVELOPER LAPTOPAI tool + agentHOOK READY R-SECURE SERVERYour serverWAITING RAKSYONNo eventsNO SECRETS THE SECRET VALUE NEVER LEAVES THE LAPTOP 

          
Nothing has left the laptop

        

      

    

  


  

    

      

        
What gets recorded
What R-Secure keeps, and what it never does.

        
Everything in the first column lives only on your R-Secure server.

      

      

        
Recorded · on your server
The activity

          
    
            
  • Which AI tool acted, on which machine and in which project
    • 
            
  • File paths read and edited, and searches run
    • 
            
  • Shell commands and MCP tool callsWith any secret in them redacted first
    • 
            
  • Which rules matched, and a fingerprint for any secret
    • 
          

        

        
Optional · your choice
Prompt text

          
    
            
  • What the developer asked the AI tool, shown next to what it did
    • 
            
  • Turn it off for your organization and only actions are kept
    • 
            
  • Stored on your server like everything else
    • 
          

        

        
Never stored · anywhere
The sensitive parts

          
    
            
  • Secret values: keys, tokens, passwords, connection strings
    • 
            
  • File contentsScanned in memory on the laptop, then thrown away
    • 
            
  • Secrets typed into commandsReplaced with a redacted marker before saving
    • 
          

        

      

    

  


  

    

      

        
Network connections
Every connection R-Secure makes.

        
There are three. Only one of them leaves your network, and it carries counts.

      

      

        
FromToWhat it carriesWhere

        
AgentEach developer machineR-Secure serverHosted by you
One event per action: tool, machine, project, path or command, rules matched, fingerprint. No secret values, no file contents.
Inside

        
Admin's browserYour security teamR-Secure serverDashboard
Sign-in and dashboard pages, served from your own server.
Inside

        
R-Secure serverHosted by youLicense serviceRAKSYON
Usage counts only: number of agents, number of events, server version. Never file names, commands, prompts or code.
Outside

      

      

        
// the whole license check: all RAKSYON receives
{
  "agents": 12,
  "events": 450,
  "server_version": "1.4.2"
}

        
What R-Secure doesn't do
          
It doesn't sit between your AI tools and their model providers. Claude Code and Cursor still talk to their own services, as they do today.

          
To keep a critical file out of a model's context, the hooks stop the read before it happens. For everything else, R-Secure records the access so your team knows exactly what each AI tool saw.

        

      

    

  


  

    

      

        
Six promises
A security tool that doesn't become a security risk.

        
R-Secure sees the same sensitive files your AI tools do, so it's built to keep almost nothing.

      

      

        
01
Secrets are never stored
When a key or password turns up, only the rule name and an 8-character fingerprint are kept. The secret never reaches a log, a database or a report.

        
02
Contents scanned in memory
File contents are checked on the developer's machine and thrown away immediately.

        
03
Secrets in commands redacted
A key typed into a command is replaced with a redacted marker before anything is saved.

        
04
Self-hosted
All activity data lives on your server. The license check carries counts, never content.

        
05
No slowdown for developers
The hooks write one line and exit. If your R-Secure server is down, AI tools keep working normally.

        
06
Hard to switch off quietly
Tampering with R-Secure's files or hook settings is itself flagged. On Linux, the kernel watcher runs as a protected system component the AI tools can't edit.

      

    

  


  

    

      Your controls
      
You decide what's kept, and for how long.

      

        
Retention
Older events are deleted from your server automatically. Saved daily reports aren't affected.
90 days by default

        
Prompt logging
Record what developers asked, or turn it off for the whole organization.
On or off

        
Users and roles
Admin accounts with roles decide who can see activity in the dashboard.
Per person

        
Machine tokens
Every developer machine has its own access token. Revoke one and that machine stops sending events.
Per machine

        
Where it runs
Agents run on Linux (Ubuntu), macOS and Windows. The kernel watcher runs on Linux only.
Your machines

      

    

  


  

    

      

        Report a vulnerability
        
Found something? Tell us first.

        
We want to hear about security issues in R-Secure, and a person on the RAKSYON team reads every report.

        
security@raksyon.tech

        

          security.txt · RFC 9116
          
Contact: mailto:security@raksyon.tech
Expires: 2027-05-04T00:00:00.000Z
Preferred-Languages: en
Canonical: https://raksyon.ai/.well-known/security.txt
Policy: https://raksyon.ai/privacy.html#disclosure
Open file

        

      

      
    
        
  • 01
    Include the details. Steps to reproduce, the R-Secure version, and the platform: Linux, macOS or Windows.
    • 
        
  • 02
    Keep it private for now. Give us time to fix the issue before you share it publicly.
    • 
        
  • 03
    We'll work with you. We'll confirm the issue, keep you updated, and agree a disclosure date with you.
    • 
        
  • 04
    Don't send secrets. If a report needs a real key or customer data to show the problem, describe it instead.
    • 
      

    

  


  

    

      
Keep secrets inside. See it on your network.

      

        
A walkthrough with the RAKSYON team on your own infrastructure.

        

          Talk to us 
          What R-Secure does