Security

Transport

The hosted service is served over HTTPS. Everything your machines send it — device tokens, transcripts, control commands — travels over that TLS connection.

Self-hosting is your call, and Longhouse will not add TLS for you. Native clients (the CLI, the Machine Agent, the macOS and iPhone apps) accept a plain http:// address only for loopback and for Tailscale addresses, because WireGuard already encrypts that link. A plain http:// address on your local network is refused unless you opt in explicitly, and then its device token and transcripts cross your network in the clear. Anything else needs https://. Put the instance behind TLS, or keep it on your tailnet.

Authentication

Self-hosted instances use password authentication by default. The hosted service supports OAuth providers. Longhouse never stores third-party passwords.

Device Tokens

Each machine you connect gets its own device token. The server stores only a SHA-256 hash of it, never the token itself, and you can revoke a machine's tokens at any time in Settings → Devices.

What Sessions Contain

Longhouse stores agent transcripts as they were produced. It does not scrub secrets out of them, so anything your agent printed — keys, tokens, passwords — is in the archive. Anyone who can read your Longhouse account can read those values.

Retention and Deletion

We keep your transcripts until you delete them. Nothing expires on a timer, and we don't thin old history to save space.

There is no delete button in the app yet, so you email us and we run it within 7 days. The deletion itself is immediate: it removes the session from the live service — the catalog rows, the search index and its embeddings, and the stored transcript bytes. A real delete, not a flag that hides the session from view. The server reports what it removed, and it names anything it could not reach instead of claiming a clean sweep: today that always includes an older archive copy of the transcript on the server, and any media file another session still points at.

Backups are the honest exception. We back the hosted database up off-site, encrypted, and a snapshot taken before you deleted something still holds it until that snapshot ages out — recent copies for two days, daily copies for two weeks, eight weekly copies, twelve monthly copies, and two annual copies. Deleted data can remain in those encrypted backups for up to two years. We never restore deleted data back into the service.

So deleting a session is not the same as un-leaking a secret. If a transcript ever held a live key, token, or password, rotate it. Rotation is the only thing that actually revokes it.

Your Controls

You have control over your data:

• View - See your sessions and timeline data
• Revoke - Revoke a machine's device tokens in Settings → Devices
• Delete - Delete a session or your whole history. There is no delete button in the app yet, so email support@longhouse.ai from your account address and we run it

Responsible Disclosure

If you discover a security vulnerability, please report it to us:

• Email: support@longhouse.ai
• Include details and steps to reproduce
• Allow reasonable time for us to address it