A secure local coding agent, with the boundaries stated
A local coding agent keeps model inference on a machine you control. That is a data-flow fact, not a certification. This runtime is not a hosted service and not a sandbox, and we hold no compliance certification.
Data flow
The CLI sends a coarse machine profile and usage events by default. That is the recommendations feature, and it sends no prompts, files, paths, or keys. Turn it off for one command with --no-recommendations, or for every command with oloop recommendations off. Hub commands and model calls still use the network when it is off.
| Path | What it carries | How to turn it off |
|---|---|---|
| Model inference | The prompt, the context, and the output, to the host or endpoint in the model row. | Use a local host. A remote row sends them to that endpoint by design. |
| Machine profile | A coarse profile for setup recommendations: platform, arch, RAM class, CPU core count, chip family, OS family, and GPU class. No hostname, files, paths, or keys. | A --no-recommendations flag on the command, or oloop recommendations off. |
| Usage events | The same profile, plus event kind, manifest and version, harness, host, machine class, outcome, and engine version. | oloop recommendations off, or a per-command --no-recommendations. |
| Public manifest | If you publish: the bundle, manifest, AGENT.md, and your handle. Publishing is a deliberate act. | Do not publish. A local manifest never leaves the machine. |
| Handle and request counts | The Hub stores your handle and aggregate request counts public under it. Per-handle stats are not anonymous. | Use a local manifest with no handle, and do not publish. |
| Session machine profile | A machine profile stored against your browser session, used to keep recommendations stable. | DELETE /api/session/machine. It stops future sends from that session and does not erase counts already aggregated. |
| This site (GA4) | A page path, which can include a public handle, plus the referrer. The CLI has no control over it. | Nothing in the CLI. /privacy has the inventory and the retention. |
| A remote model endpoint | Whatever you send it: prompt, context, and output, under that provider's policy. | Use a local model. Read the endpoint's policy before you send anything. |
The field lists match /docs#data. The full inventory, retention, and deletion rules are in /privacy.
oloop recommendations off
oloop host start --no-recommendationsEvidence you can keep
All four survive the machine, because they live in the project or the catalog. None of them audits the runtime.
| Artifact | What it proves | What it does not prove |
|---|---|---|
| Bundle checksum | The bytes you applied are the bytes with that digest. | It does not show the contents are safe, correct, or free of a vulnerability. |
| oloop.lock | The host, harness, and model revision this root resolved. | It does not show the upstream model still exists, or that a later run uses the same identity. |
| Evidence JSON | One pinned setup ran one qualification probe on the stated hardware and date. | It does not show the agent is secure, the model is good, or where your data goes. |
| Run receipt | The run outcome and whether the result was submitted. | It is not a signed audit log, and it does not record what the model saw. |
The setup page links each record. Read the record, not the badge.
What we do not claim
This runtime is not a hosted service. It is not a sandbox: an agent can touch what the manifest's tools allow, and the harness runs with your user's permissions unless you change them.
It is not SOC 2 certified, not ISO 27001 certified, not HIPAA compliant, and not FedRAMP authorized. A VPC, a private subnet, or an IAM boundary is your control surface, not a badge for this runtime.
It is not legal advice. Model licenses vary by model and by publisher, and the license that applies to your output is the one attached to the model you chose. Read it.
Air-gapped installs
Host installs download pinned assets from upstream. On an air-gapped network the install fails at that download step, and a pinned bundle already in the project root still runs.
A fully offline install needs a local mirror of those assets. We have not built one, so an air-gapped host install is not a supported path today.
Review
Reviewed 2026-10-20 against the CLI's data-flow behavior and the recommendation controls. It is re-read once a year, and whenever those controls change. A row that disagrees with the CLI is a bug in the row.
Install
Install the CLI, then pick the setup for your machine class.
curl -fsSL https://oloop.run/install.sh | shQuestions
Is a local model private?
Local means inference runs on a machine you control. Recommendations are on by default and send a machine profile and usage events, and a remote endpoint you choose sees what you send it.
Are you SOC 2 certified?
No. We are not SOC 2 certified, not ISO 27001 certified, not HIPAA compliant, and not FedRAMP authorized.
Can I run this fully offline?
A bundle you already pulled can run offline. A host install downloads pinned assets from upstream, and a mirror for those assets is not built.
Does the evidence prove the agent is safe?
No. It records one passing probe on one machine. It is not a security review, and it does not audit the model, the harness, or their permissions.