The default should be easy to explain

The first answer to “where does my agent history go?” should not require an architecture diagram. Termyte keeps its configuration and records in a local SQLite database: traces, tasks, observations, memories, context decisions, and feedback.

Local retrieval does not require an embedding API. That keeps the core record inspectable on the developer's machine and makes capture useful even when synthesis is disabled.

Optional processing

During setup, you can choose an authenticated Claude Code, Codex, or OpenCode path, an OpenAI-compatible API, or capture-only mode. If processing is enabled, redacted trace-derived content is sent to the selected provider so it can form observations or memories.

Capture-only mode records activity without forming provider-backed observations and memories. It is useful when the local trace matters more than immediate synthesis, or when a team wants to inspect capture before enabling processing.

Redaction is a control, not a guarantee

Redaction is heuristic. It can reduce exposure, but it cannot guarantee that every secret, token, or sensitive value is removed. Teams still need provider controls, repository hygiene, and their own data-handling policy.

Termyte is also not a sandbox, malware defense, or runtime safety system. It records connected activity; it does not contain the agent or validate every command.

The product boundary

The system is designed to make data movement legible. You should be able to tell what was captured locally, what was sent for optional processing, and what was later used as context.

That is more useful than claiming local storage makes the whole workflow safe. Privacy is a system property, not a checkbox in an install command. Termyte can make the path clearer and reduce unnecessary exposure. It cannot remove the responsibility to choose providers and integrations carefully.