数据与安全

查看数据存储位置、按设计会离开服务器或由客户端发出的请求范围，以及外部应用的隔离边界。

数据隔离、工具权限分档与 Doorman 出网管控在你的 OpenMousse 服务器上默认开启，无需额外配置；你也可以在服务器上随时运行 bash ~/openmousse/check.sh 检查各项服务的运行状态。

OpenMousse 的设计原则是将数据留在只属于你的服务器上，并严格限制每一次出网请求与外来信息的权限。我们不投放广告，不出售数据，不用你的数据训练模型；全部核心代码以 AGPL-3.0 协议开源。

数据存储在哪里

你的对话记录与附件、世界树（SQLite 数据库或 Markdown 笔记库）、Zen 笔记、Apple 健康每日汇总，以及各功能 Agent 的独立记忆与看板数据，全部存储在只属于你的服务器上（你自备的机器，或我们托管的专属云服务器）。

•访问权限：上述数据仅供你已配对的客户端设备，以及你服务器上的各 Agent 按各自权限读取。
•外部 AI 应用的隔离：你通过 MCP 手动授权接入世界树的外部 AI 应用（Claude、ChatGPT、Gemini、Notion、Claude Code）仅能读写世界树，无法读取你的对话记录、健康数据及各功能 Agent 的独立记忆。
•托管服务器访问政策：如果你使用我们托管的专属云服务器，只有当你为排查故障明确授权时，运维人员才会登录你的服务器，并留下你能随时查看的操作记录。

什么数据会离开你的服务器

按设计会离开你的服务器（或由客户端发出）的内容包括：

目标服务	发送的数据范围	边界与说明
模型服务	每一轮的消息与回答所需的记忆	发往你在 OpenClaw 中配置的模型服务商（如 Anthropic、OpenAI、Google，含备用模型），使用你自己的账号；其余的世界树叶子、历史对话与本地文件留在你的服务器上，Zen 中未点击「讨论」的想法不发给模型。
推送通知（Expo、Apple）	简短的通知标题与预览	经 Expo 推送服务与 Apple 推送服务发送；对话回复的通知包含对话名与回复的前 140 个字。
语音转写	语音消息与当面播客录音的音频	由服务器配置的转写服务处理：默认使用 OpenAI，也可换成你自己的 Whisper 兼容服务；播客录音同样走你所选的转写服务，转写后的原话与纪要保存在发起人自己的服务器与 app 中。
接入世界树的 AI 应用（可选）	世界树的读写内容	如果你将 Claude.ai、ChatGPT、Gemini 或 Notion 等应用接入世界树，这些服务会通过你设置的地址读写世界树。
连接器（可选）	对所连接应用的读写请求	在「设置 → 连接器」中接入 Notion 这类应用后，登录令牌保存在你的服务器上，由你的 claw 经你的服务器读写该应用。
营养查询（Open Food Facts、USDA FoodData Central）	食物名称或条码	记录饮食时，若某样食物不在你自己的食物库中，服务器会向上述服务查询；请求中仅含食物名称或条码，不含你的任何个人信息，查询结果缓存在你的服务器上。
分享链接与好友消息（可选）	分享内容快照、私聊消息、分享卡，或经 Doorman 复查通过的管家回复	分享链接向持有链接的人展示选中内容的快照（住址、家人名字等私事显示为灰条）。好友服务器之间互发带签名、端到端加密的消息；无公网地址时经 OpenMousse 中继（`relay.openmousse.ai`，运行于 Cloudflare）转发，中继仅见收件服务器地址、大小与时间，读不到内容也不保存（Cloudflare 可能保留 IP 地址等常规访问记录）。
代办访问的网站（经 Doorman）	网页浏览、比价与表单请求	代办 Agent 在隔离沙箱中运行；真实密码由 Doorman 在请求离开服务器的那一刻替换占位符，且只发往绑定的目标网站；提交、登录与付款均须先经你批准。
TestFlight 版的账号（Supabase 欧盟区、Resend）	邮箱、可选的名字，以及连过的 claw 列表	仅 TestFlight 版需邮箱验证码登录（验证码邮件由 Resend 发出，账号存于 Supabase 爱尔兰区，保留登录时间与 IP 等常规记录）。记录的 claw 信息仅含助手名、服务器地址、claw 类型与名字、最近在线时间；从不存储令牌、对话、记忆、健康数据与连接器凭据。网页版与自行构建的版本无账号。
app 更新查询（Expo）	app 与系统版本信息	app 向 Expo 更新服务查询新版本代码，请求中仅含版本信息，不含你的任何内容。

发言方权限与外来信息隔离

系统内核按发言方将交互严格分为三类回合，并对工具实行三档管控即将推出：

•你本人的消息：可调用全部工具（只读直接做；撤得回的直接做并附改动编号，回「撤销」即可恢复；撤不回的出确认卡并锁定参数，等你批准后按原参数执行一次）。
•你的赛博 即将推出：仅进行对话，不直接访问数据；查询或修改数据均须交由其装载的功能 Agent 处理。
•好友的 agent 与陌生人的消息：不能调用任何工具。陌生人默认一律不理；好友的 agent 发来的话仅作为参考资料，由不能使用任何工具的模型调用处理；外部网页内容则仅由沙箱内的代办 Agent 读取。
•Agent 编写的页面 即将推出：运行在隔离环境中，读不到登录信息与其他系统数据，也不能把数据发往任何地方。首次打开页面时会先列出需要读取的数据项，经你同意后仅作只读访问；页面内容更新后须重新确认。

不在这里的东西

•没有无感知的后台上传：app 里没有统计或追踪 SDK；你的对话、记忆和健康汇总都存在你自己的服务器上。
•自检输出不含密钥：运行 bash ~/openmousse/check.sh 排查故障时，终端输出不包含任何令牌、密码与 API 密钥，可直接复制给他人协助排查。

另见

•先问你（收件箱）：了解工具三档与确认卡的审批流程。
•代办与 Doorman：了解代办沙箱与密码占位符的工作方式。
•内核（agent harness） 即将推出：了解三类发言方回合的架构细节。
•隐私政策：查看关于第三方模型服务、转写服务与托管服务器的完整条款。

最后更新于 2026-10-19这一页有帮助吗？

For a complete index of the docs, see llms.txt. Append .md to any URL for the Markdown version; this page's Markdown is at security.md.

Features

Data and Security

Review data storage locations, requests that leave your server or originate from the client by design, and isolation boundaries for external apps.

Data isolation, tiered tool permissions, and Doorman outbound governance are enabled by default on your OpenMousse server with no extra configuration required; you can also run bash ~/openmousse/check.sh on your server at any time to check the status of each service.

OpenMousse is designed to keep data on a server that belongs solely to you, and to strictly limit the permissions of every outbound request and piece of incoming external information. OpenMousse serves no ads, sells no data, and never trains models on your data; all core code is open source under the AGPL-3.0 license.

Where Data Is Stored

Your conversation history and attachments, memory tree (SQLite database or Markdown vault), Zen notes, Apple Health daily summaries, and the independent memories and board data of each functional agent are all stored on a server that belongs solely to you (either your own machine or a dedicated cloud server hosted by OpenMousse).

•Access permissions: The data above can be read only by your paired client devices and by the agents on your server according to their respective permissions.
•Isolation of external AI apps: External AI apps (Claude, ChatGPT, Gemini, Notion, Claude Code) that you manually authorize to connect to the memory tree via MCP can only read and write the memory tree; they cannot read your conversation history, health data, or the independent memories of your functional agents.
•Hosted server access policy: If you use a dedicated cloud server hosted by OpenMousse, operations staff log in to your server only when you explicitly authorize access for troubleshooting, and every action leaves an audit log you can inspect at any time.

What Data Leaves Your Server

Data that leaves your server (or is sent from the client) by design includes:

Destination Service	Scope of Data Sent	Boundaries and Notes
Model providers	Each turn's message and the memories needed to answer	Sent to the model providers you configured in OpenClaw (such as Anthropic, OpenAI, or Google, including fallback models) using your own accounts; all other memory tree leaves, past conversations, and local files remain on your server, and thoughts in Zen where you have not tapped Discuss are never sent to a model.
Push notifications (Expo, Apple)	Short notification title and preview	Sent via the Expo Push Service and Apple Push Notification service; notifications for conversation replies contain the conversation name and the first 140 characters of the reply.
Voice transcription	Audio from voice messages and in-person podcast recordings	Processed by the transcription service configured on your server: OpenAI by default, or replaceable with your own Whisper-compatible service; podcast recordings also go through your chosen transcription service, and the resulting transcript and minutes are saved on the initiator's own server and app.
AI apps connected to the memory tree (optional)	Memory tree reads and writes	If you connect apps such as Claude.ai, ChatGPT, Gemini, or Notion to the memory tree, those services read and write the memory tree through the URL you configured.
Connectors (optional)	Read and write requests to the connected app	After you connect an app such as Notion in Settings → Connector, its login token is stored on your server, and your claw reads and writes that app through your server.
Nutrition lookup (Open Food Facts, USDA FoodData Central)	Food name or barcode	When logging meals, if a food item is not in your own food database, the server queries the services above; the request contains only the food name or barcode and none of your personal information, and query results are cached on your server.
Share links and friend messages (optional)	Snapshot of shared content, direct messages, share cards, or Butler replies approved by Doorman	A share link shows anyone holding the link a snapshot of the selected content (private details such as home addresses and family members' names are masked as gray bars). Friends' servers exchange signed, end-to-end encrypted messages directly; when neither side has a public address, messages are forwarded through the OpenMousse relay (`relay.openmousse.ai`, running on Cloudflare), which sees only the recipient server address, payload size, and timestamp, cannot read the content, and stores nothing (Cloudflare may retain standard access logs such as IP addresses).
Websites visited by Errands (via Doorman)	Web browsing, price comparison, and form requests	The Errands agent runs in an isolated sandbox; Doorman replaces password placeholders with real passwords only at the moment a request leaves the server, and sends them only to the bound target website; submissions, logins, and payments all require your prior approval.
TestFlight account (Supabase EU region, Resend)	Email address, optional display name, and list of connected claws	Only the TestFlight build requires email verification code login (verification emails are sent by Resend, and accounts are stored in Supabase's Ireland region, which retains standard logs such as login time and IP address). Recorded claw info contains only the assistant name, server URL, claw type and name, and last online time; tokens, conversations, memories, health data, and connector credentials are never stored. The web app and self-built versions have no account system.
App update checks (Expo)	App and OS version info	The app queries the Expo Updates service for new code bundles; requests contain only version information and none of your content.

Speaker Permissions and Isolation of External Information

The system engine strictly divides interactions into three turn types based on the speaker and enforces three-tier governance over tools Coming soon:

•Messages from you: Can invoke all tools (read-only operations run immediately; reversible operations run immediately and attach a change ID so you can reply Undo to revert; irreversible operations generate a parameter-locked approval card and execute once with the original parameters after you approve).
•Your Cybers Coming soon: Engage in conversation only and do not access data directly; querying or modifying data must be handed off to the functional agents mounted on the Cyber.
•Messages from a friend's agent or a stranger: Cannot invoke any tools. Strangers are ignored by default; messages from a friend's agent are treated strictly as reference material and processed by a model call that cannot use any tools; external web content is read only by the Errands agent inside its sandbox.
•Agent-authored pages Coming soon: Run in an isolated environment, cannot read login credentials or other system data, and cannot send data anywhere. Opening a page for the first time lists the data items it needs to read and grants read-only access only after you agree; if the page content is updated, you must confirm again.

What Is Not Here

•No silent background uploads: The app contains no analytics or tracking SDKs; your conversations, memories, and health summaries all live on your own server.
•No secrets in diagnostic output: When you run bash ~/openmousse/check.sh to troubleshoot, the terminal output contains no tokens, passwords, or API keys, so you can copy and share it directly when asking for help.