# Provider security

> How the provider agent connects, which credentials it holds and how they're protected, what the platform sends you, and what your data declarations commit you to.

Source: https://0.0.0.0:3000/docs/providers/security
Documentation index: https://0.0.0.0:3000/docs/llms.txt

## Claude Code login

The Claude Code source uses the login owned by the native CLI on your provider
machine. The agent does not copy or export that credential. Each request gets an
isolated temporary configuration that excludes your account identity and project
history. Managed hooks/settings are rejected before customer context is sent;
local instruction files, built-in tools, plugins, memory and session persistence
are disabled. File mentions such as `@path` stay literal and do not attach files
from your provider machine. Temporary worker data is removed when the worker exits normally.

Customer-declared tools execute in the customer's client, not on your provider
machine. A private loopback endpoint only supplies their schemas while the request
runs; it cannot execute them. Your regular Claude conversations are not resumed.


## Outbound-only connection

The agent connects out to the platform gateway over HTTP/2 and TLS 1.3, with full certificate validation. The platform never connects in to you.

- You open no inbound ports and need no public address, certificate or inbound firewall rule.
- The agent receives its gateway addresses from the platform after authenticating. Each profile keeps two connections to different gateways, so a gateway update doesn't take your endpoint offline. Losing both connections or stopping the agent can interrupt requests.
- Keep the machine's clock synchronized. Reports with invalid timestamps are rejected.
- Reconnecting never resends a request whose outcome is uncertain, and the agent refuses duplicates of requests it's still running.

Your inference source is separate. The agent reaches it at the address you configure: loopback, a private network or, for cloud connectors, the provider's official address. Don't expose an unauthenticated inference engine on a public interface.

## Credentials

| Credential | Purpose | Where it's stored | Used by |
| --- | --- | --- | --- |
| Your sign-in | Setup, publishing, status and other commands you run | A rotating refresh credential in the profile root's owner-only `human-auth/` directory. Access tokens live only in the memory of the command using them. | Commands, the terminal UI and the desktop app. Never the serving daemon. |
| Endpoint credential | Authenticates your daemon's connection for one endpoint | The profile's owner-only secret store, as `local://transport-enrollment`, or an `env://` reference | The serving daemon |
| Source credentials | Access to your inference source: API keys and browser sign-in state | An `env://` environment variable or the profile's owner-only secret store | The serving daemon and discovery |

**Your sign-in** uses a browser sign-in with PKCE on this machine, or device authorization for SSH and headless machines. `numes auth logout` revokes the refresh credential before deleting it. For approved headless automation, you can reference a token with `access_token_secret = "env://NAME"` so it never appears in a file or argument.

**The endpoint credential** is created by setup and shown or stored once; the platform can't show it again. **Reconnect agent** replaces it and invalidates the old one immediately. See [Reconnecting the agent](/docs/providers/lifecycle#reconnecting-the-agent).

Connected sessions are also checked after registration. Replacing or revoking an
endpoint credential disconnects its sessions; revoking a runtime key disconnects
only workers using that key. The platform checks new requests against current
authority before dispatch. An ordinary endpoint closure lets already-admitted
requests drain; an administrator credential revocation interrupts its sessions.

**Source credentials** stay with you. A self-hosted agent never sends them to the platform or includes them in anything it reports. For hosted sources, see [Hosted sources](/docs/providers/hosted).

## Local protection

- **No secrets on the command line.** Options that look like secrets are rejected. Keys are typed into masked prompts, read from an environment variable you name, or referenced as `env://NAME` or `local://NAME`. See [Profiles and configuration](/docs/providers/profiles#secret-references).
- **Owner-only storage.** Every directory and file the agent writes is readable only by your user. The agent refuses storage that other users can read, that someone else owns, that's reached through a symbolic link or that lies inside a Git repository.
- **No implicit configuration.** The agent never loads `.env` files or searches the current directory for configuration. Named profiles ignore broad environment overrides unless you pass `--allow-env-overrides`.
- **No secrets in output.** Status, `config show`, doctor results, logs, exports, JSON output and error messages never contain a resolved secret, token or private connection detail.
- **Local control only.** Each running profile is controlled through an owner-only Unix socket. The agent never opens a TCP port for administration; the desktop app manages machines over local pipes or SSH.
- **Content-free logs.** The profile log records operational events only: no prompts, outputs, credentials or private addresses.

Anyone who can read your profile root as your user can read these credentials. Treat backups and copies of it as secrets.

## What the platform sends you

For each request routed to you, the agent receives what it needs to serve it: the model, the messages and media, generation parameters, tool definitions, response-format requirements, cache directives, the deadline and cancellation.

The platform doesn't send:

- the customer's account, organization, API key, email address or IP address;
- attribution headers such as `HTTP-Referer` and `X-Title`, or the request's `user` field;
- the customer's session ID or prompt-cache key.

Where cache affinity needs a value, the platform sends an opaque hint with no content or account identifiers. Platform checks use synthetic requests, never customer content.

## What you send back

Your agent returns the output and the upstream's usage for each request, plus content-free health and capacity reports. Usage is validated against your published offer and the request before it settles at your published prices.

What the platform keeps about your endpoint contains safe categories, codes and timings, never request content or upstream error text.

## Your data declarations

Every endpoint declares how its source handles customer data. Customers see the declaration and can filter on it.

:::fields Endpoint data policy
- `collects_data` `boolean` — Whether the source keeps or uses request data beyond serving the request, for example for training or logging.
- `retention` `string` — `none`, `limited`, `indefinite` or `unknown`.
- `maximum_retention_days` `integer` — Required with `limited` retention.
- `country_codes` `string[]` — ISO country codes where the source processes data.
- `regions` `string[]` — Region identifiers where the source processes data.
:::

Setup suggests a starting declaration for each source type. It isn't a fact about your setup: a cloud connector forwards content to another company whose own terms apply, and the agent can't know what an arbitrary compatible server does. Review it during setup with `--collects-data`, `--retention`, `--retention-days`, `--country-code` and `--region`, or in the terminal UI's connection form. Turning off data collection sets retention to `none`.

| Customer setting | Your endpoint is excluded when |
| --- | --- |
| `provider.data_collection: "deny"` | It declares data collection. |
| `provider.zdr: true` | It declares any retention. |
| `provider.regions` | None of its declared countries or regions match. |

Declarations are binding commitments under the provider terms. Inaccurate declarations lead to suspension and withholding of earnings.

Changing the data policy of an approved endpoint is reviewed like any other endpoint edit, and the approved declaration applies until the change is approved.

## Recommended practices

- Bind local inference engines to loopback, or protect them with an API key when other hosts can reach them.
- Prefer `local://` storage or a service manager's protected environment for keys; never put keys in unit files other users can read.
- Run each source under a dedicated user account if the machine is shared.
- If a credential may have been exposed, replace it: the endpoint credential with **Reconnect agent** or by deleting the endpoint, and source keys at the source.
- Keep the agent updated. Background services update automatically unless you turn it off; otherwise run `numes update`. A `protocol_mismatch` or `agent_upgrade_required` status means your agent and the platform run incompatible versions, and an agent older than the platform accepts is refused with `agent_update_required`. See [Install and update](/docs/providers/install-and-update#minimum-agent-version).
- Check that your upstream's terms permit serving its models to third parties before you publish them.

## Next steps

:::cards
- {tree} [Profiles and configuration](/docs/providers/profiles) Where credentials and state are stored.
- {badge} [Review and lifecycle](/docs/providers/lifecycle) Reconnecting agents and deleting endpoints.
- {drive} [Hosted sources](/docs/providers/hosted) How the platform protects hosted keys.
- {lock} [Provider data policies](/docs/privacy/provider-data-policies) The customer's view of your declarations.
:::