Your machine.
Your data.
Your rules.
Your conversations, files and credentials stay on your machine unless you decide otherwise, and each employee reaches only what you connected it to.
Local by default.
Employees run on hardware you own, with their files and memory on your disk. What leaves is the model call, to the provider you chose, and pointing it at a local model keeps even that on the machine. You can also run an employee in the cloud when it needs to be awake at 3am, and that is a choice you make per employee rather than a condition of using the product.
The employees that must not phone home never have to.
Your machine
LLM provider
Your key and your terms, or the Right Fit Gateway.
Ed25519 Signature
Verified against publisher key
VirusTotal Scan
0 / 72 engines flagged
Signed binary
Plugin code the model cannot read or rewrite
Signed and scanned.
Every tool in the marketplace is signed with Ed25519 by its publisher and scanned by VirusTotal before it reaches you. Nebo verifies the signature on install — if anything was tampered with, it won't run.
Plugins are native binaries the model cannot read or rewrite. Skills are markdown you can read yourself, and a workflow can run shell commands, which is exactly why what an employee may touch is enforced in code and gated on approval rather than requested in a prompt.
No phone home.
The runtime sends no telemetry, no usage analytics and no conversation data. Bring your own provider key and your conversations go straight from your machine to that provider, with us nowhere in the path. Route through NeboAI instead and we handle the request in order to bill it and to fit it to the right model. We do not train on it either way.
Privacy isn't a toggle. It's the default.
No telemetry
The runtime reports nothing back to us
Your own key, our own absence
On BYOK we never see the request at all
No shared machine
Each employee is scoped on its own; one cannot reach another’s logins
Want the full technical deep dive?
Our security architecture page covers the layers of protection, the capability model behind the approval gate, and the vulnerability hardening log.
Read the full security architectureAI that protects you,
not the other way around.
Security shouldn't be something you have to think about. With Nebo, it's built into every layer.