Security & Data

• Conversations, memories, routines, files, screenshots, and browser profiles are stored in the deployment you control.
• The control plane listens on loopback by default.
• Provider keys are read by the local orchestrator, not the browser renderer.
• Remote providers receive task data when you configure and use them.
• Bots may retain signed-in browser state in persistent browser profiles.
• Local APIs depend on network isolation. They are not public endpoints with account authentication.
• Some deployments give Unbound access to Docker. Access to the Docker socket can grant host-level control.

• Keep the control plane on loopback unless remote access is necessary.
• Do not expose local control or computer endpoints directly to the public internet.
• For remote access, use an authenticated private network or a secured reverse proxy with TLS, restrictive firewall rules, and exact allowed origins.
• Use dedicated accounts and the least permissions required for each bot.
• Keep provider keys out of source control, logs, screenshots, and public issues.
• Protect the host, backups, browser profiles, and persistent volumes. Review a provider's retention settings before sending confidential or regulated information.
• Apply updates deliberately and revoke unused credentials promptly.

Report a security issue privately to [email protected]. Do not post an unpatched vulnerability, exploit, credential, personal information, or sensitive log publicly.

Third-party software included with Unbound remains subject to its own license terms. Review the notices supplied with the release, along with the privacy terms for each AI provider and connected service, before sending confidential or regulated information.