Security overview

A scannable summary of TokenShift’s security posture. Each section links to the page with the full detail.

What PointFive can and can’t push

No behaviour-changing control plane. Rules, configuration, opt-out, and per-fleet behaviour are install-time only, baked into the binary and the enrollment manifest the admin deploys via MDM. The one thing PointFive controls remotely is release availability — which version is offered, when, to what fraction of the fleet. Auto-update is opt-in on the client. → Installation & distribution §1

Encryption on the wire

Hybrid-encrypted on the device against a public key pinned in the binary at build time. The private key never leaves PointFive’s key-management system. A compromised laptop or manifest yields ciphertext, not plaintext. → Installation & distribution §5

Signed releases

Binaries are code-signed for each OS (Apple Developer ID, EV code signing, GPG repositories). Auto-update artifacts carry an additional signature that the client verifies before swapping; a mismatch aborts the update. → Installation & distribution §3

Device-side redaction

Sensitive fields are scrubbed on the device before encryption: command arguments are stripped to a shape, and content fields (output, prompts, file contents, paths) are replaced with one-way hashes — the originals never leave the machine. A startup self-check disables telemetry if the redactor misbehaves (fail-closed). → Data contract → Redaction

On-device prompt classification

Categorizing what a prompt is about (debugging, feature work, research, and so on) happens on the endpoint, not by sending the prompt to an external model to be classified. A small local model — a short-lived helper process, not a persistent service — reads the prompt once, produces a label, and discards it. Only the label ships in telemetry; the prompt text itself is never transmitted, to TokenShift’s backend or anywhere else, for this or any other purpose. → Installation & distribution → Local intent classifier

What never goes on the wire

Bash output, tool inputs, file contents, transcripts, environment variables, raw file paths, and commit messages never leave the device in clear — sensitive fields are one-way hashed before send, so only hashes ship, never the content. The developer’s raw email is read once locally to compute a pseudonymous user_id, then discarded. Git context (branch, repo URL, PR number) is sent as non-identity enrichment. → Data contract → What the contract does NOT send

Local recovery cache

A short-lived local cache of compressed-away output, so the agent can tokenshift recover <id> the original back. Local-only, never shipped, off when disabled in the manifest. The recovery_retrieved signal records that a recovery happened — never the content. Only reachable on harnesses whose proxy runs unsandboxed (Claude Code, GitHub Copilot CLI) — Cursor and Codex sandbox the proxy, so there’s nothing for it to write. → Data contract → Recovery cache scope