What we can prove, and what we have not done yet

01

The short version

Centurion is software that runs on a computer you own, in a building you control. We sell the licence; we do not sell, rent or hold the machine. Inference runs either through a model provider you choose, or — with Core — entirely on that machine.

Most of what an IT department needs to know is therefore not about our security posture. It is about where the boundary sits, and who holds the keys on each side of it.

If you only read one section, read 02 and 03. Those are the two questions that decide the outcome.

02

What never leaves the building

Your Soul document, your memory, your projects, your files and your conversation history are stored on your machine. They are not replicated to us and we have no facility to read them.

No account of ours is required for the system to operate. There is no central store of your content to be breached, subpoenaed or leaked, because that store does not exist.

03

What does leave, and where it goes

We are precise here on purpose. The following is the complete list of outbound traffic the software originates, and what each one carries.

• Inference — your prompts go to whichever model provider is configured. With a cloud provider (DeepSeek by default, and the Brain also supports OpenAI, Anthropic, xAI, Google, MiniMax, OpenRouter and Nous Research) your prompt text leaves the machine and is handled under that provider’s terms. With a local model via Ollama, nothing leaves. This is the one line where the answer depends on your configuration, and it is why Core exists.
• Licence check — see 04. Sent to our licence server. Contains no content.
• Update check and download — the installer and its manifest come from a public release bucket. No configuration or usage data is transmitted.
• The phone Remote — when used away from your network, it connects through a relay we operate. The relay carries the session; it is not a store of your content. Use it on your LAN only and the relay is never involved.
• Support, if you open a ticket — you send what you choose to send. Nothing is collected automatically.

No telemetry. The software ships no analytics SDK and we operate no telemetry endpoint — verified 22 Sep 2026 by reading the outbound endpoints and the dependency set, not by asking the developers. Usage statistics do exist, but they are computed and stored locally on your own machine for your own /insights view, and are never transmitted to us.

04

The licence check — every field, named

This is the only automated contact with our servers. It happens at activation, and again if a machine needs re-issuing after hardware failure. Read from the source, the request contains exactly six fields:

• • the activation code you were issued, and the same value under a legacy alias
• • a device fingerprint — see 05 — under two field names, hardware_id and machine_fingerprint
• • an install identifier generated on your machine
• • the API key, if your configuration has one
• • the licence tier

No files. No prompts. No conversation content. No directory listing. No installed-software inventory. No hostname — and that omission is deliberate, see 05.

05

The device fingerprint — what it is, and what it is not

A licence has to be bound to something, or one licence serves a thousand machines. We bind it to a hash derived from the following, and nothing else:

• • an OS-level machine identifier (the platform UUID on macOS, /etc/machine-id on Linux, the MachineGuid on Windows)
• • the board or SMBIOS serial, where the hardware exposes one
• • the operating system family
• • the install identifier

The hostname is deliberately excluded, because it is trivially changed and would therefore have made the fingerprint unreliable — a decision recorded in the source. The values are combined into a single hash; the raw identifiers are not transmitted as a machine inventory.

06

Updates, and how you verify what you install

Releases are published to a public bucket with a published SHA-256 checksum for every artefact. You can verify the checksum before you run anything, and we would rather you did.

Security patches ship as part of the licence — there is no separate support tier to buy in order to stay patched, and no upgrade gate that withholds a fix.

• • Every installer publishes its SHA-256. Verify it.
• • Every Linux installer is signed with our release key. Import it once and Fedora verifies the publisher before installing.
• • Patches are not gated behind a support tier.
• • Release notes name what changed, including security-relevant changes.

Signed as of 23 September 2026: our RPMs now carry an OpenPGP signature from Centurion AI Agent Limited, so Fedora verifies both the publisher and the payload before anything is installed. The public key ships with the release (`centurion-release-pubkey.asc`) and its fingerprint is 25CB 4090 1F83 44D3 704F 9A4A C9E7 4757 8FA4 1F8F. Import it once — `sudo rpm --import centurion-release-pubkey.asc` — and the “unknown publisher” warning stops appearing. You are still verifying by checksum as well; the signature is added to that, not a replacement for it.

07

If Centurion stops existing

Small vendors get asked this, and most answer it badly. Here is the honest position.

You own the computer. The software is installed on it and runs locally. If this company disappeared tomorrow: the machine keeps working, your data keeps working, and your files are readable, on hardware that is already yours and already in your building.

• • Your hardware is yours outright. Nothing is leased, nothing is reclaimed.
• • Your data is on your disk, in open formats, not in a service we can switch off.
• • The agent runs locally; you would lose updates and support, not access. This is a weaker dependency than a hosted product, where the same event means the tool stops that day.

What we will not claim: that nothing breaks. A cloud-model configuration would stop, because that dependency is the model provider’s, not ours. Core exists precisely to remove it.

08

Who else touches your data

The machine and its contents are outside this list entirely. What follows is the complete set of third parties involved in operating our business, and what each one sees.

• • Vercel — website and API hosting
• • Supabase — account, licence and subscription records
• • Stripe — payment processing; card data never reaches us
• • Resend — transactional email
• • GoHighLevel — enquiries and CRM
• • Cloudflare — CDN and edge protection
• • Your chosen model provider — prompt text only, if you run a cloud model. Not involved at all on Core with a local model.

Account, billing and support data traverse these parties. Your Centurion content does not — it never reaches any of them, because it is not collected from your machine in the first place.

09

How the alternatives compare on custody

This is not a feature comparison. Features age badly and you can read them anywhere. This is the one question that decides whether an IT department can approve a tool that reads your documents: who else can see what it processes, and who can switch it off.

Where a vendor has answered that question themselves, we quote them rather than characterise them. Every quotation below was re-read on the vendor’s own site on 22 September 2026, and the source is named for each. If any of them changes their terms, this page is out of date and we want to know.

• Cloud assistants — Anthropic, in its own privacy policy: “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings. Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review…” Your data sits on their infrastructure, under their terms, and their reviewers can read it.
• Google Gemini, on screen automation, in its own support documentation: “Gemini takes screenshots, which can include any info visible in the app. Screenshots are reviewed by trained reviewers and used to improve Google services if Keep Activity is on. Don’t enter login or payment information into Gemini chats.” That is Google telling you plainly not to put sensitive information in front of it.
• Grok Bot — xAI’s own product page: “Every Grok Bot shares one persistent cloud computer. Your Bots share that machine (files, browser, logins)… Isolation is per user, not per Grok Bot.” Isolation by user rather than by bot, on a machine that is theirs and not yours.
• ClawBox — a legitimate comparison, and they ship real hardware you do own. That is the right instinct. The honest difference is what runs on it: you own the box, and somebody else’s project owns what runs inside it — software you did not select, cannot audit, and cannot hold to a standard.
• OpenClaw, Hermes Agent, Ollama — these are allies of this position, not targets. Open-source and self-hosted, they are far closer to what we do than to the cloud, and we would rather be honest about that than score a cheap point. The real difference is build-it-yourself against an accountable vendor: you can install one yourself for nothing, and then you own the maintenance, the upgrades, the security patches and the consequences, with nobody to warrant the result.
• Apple — the strongest of the cloud-side positions, and the benchmark rather than a target. Apple Intelligence runs on-device with Private Cloud Compute, and Apple’s own material states the data is not stored or made accessible to Apple. That is genuinely good, and it is still only half the answer: the second half is that you did not choose it, cannot hold it to a standard you set, and cannot switch it off.
• Centurion — your content is stored on your machine and is never collected from it. The licence check transmits a device fingerprint and no content, and every field it sends is named in section 04. There is no analytics SDK and no telemetry endpoint. With Core, the model provider is removed as well, so inference is local and nothing leaves the building at all.

We have deliberately not scored ourselves perfectly. We hold no SOC 2 and no ISO 27001, and our RPMs were signed only on 23 September 2026 — see section 06. A comparison that ranks its author first on every line is a comparison you should not believe, and you would be right not to.

10

What we have not done

This section is the reason to believe the rest of the page. A small vendor that lists only its strengths is telling you it expects you not to check.

We hold no SOC 2 report. We hold no ISO 27001 certification. We have not published a third-party penetration test. We are a small company with a small team, and no audit has been commissioned by anyone yet.

• • Request SOC 2 or ISO 27001 and the honest answer today is: we do not have one.
• • Request a pen test report and the honest answer is: none published.
• • If your policy requires either before you can approve, that is a real blocker, and you should say so rather than let us imply otherwise.

What we can evidence instead: the source-level facts on this page, a published release checksum for everything you install, and the ability to hand you the actual activation request your machine will send so your team can read it before it goes out.

11

Reporting a vulnerability

If you or your team find something, we want it. Write to the security address below with enough detail to reproduce it, and you will get a human reply rather than a ticket number.

We will tell you when it is fixed, and — where it affected you — what it meant.

We do not operate a paid bounty programme. We do credit reports publicly when the reporter wants that.

12

Ask us the questionnaire

If you are the person who has to approve this, send us your data-protection questionnaire, your security review template, or your vendor onboarding pack. Any format.

A commercial answer to a security question is worth nothing to you, because you are the one who has to sign it. We would rather send the unimpressive true answer than the impressive one you cannot rely on.

Say what you need, and we will tell you plainly whether we can meet it. If we cannot, you have saved yourself a procurement cycle.