Network activity inventory

Two things are true of every row below and are enforced in code, not by policy:

• No screenshots or pixels are ever sent to any endpoint, ever (see Screenshots and pixels never egress).
• Cloud AI is the only thing that transmits your content, and only when you opt in. Even then it transmits derived text, never images.

The eight endpoints

All paths are on the Noesa proxy Worker (the host your app is configured to use). "Auth header" is what the client sends to identify itself; the proxy strips all such headers before any call to the upstream provider (buildUpstreamHeaders, worker/src/headers.ts).

Source for each row: worker/src/proxy.ts (handleLlm, row 1); worker/src/endpoints.ts (handleWarm, handleLicenseValidate, handleUsageReport, handleUsageFree, handleAnalytics, handleDiagnostics, rows 2–7); worker/src/webhook.ts (handleBillingWebhook, row 8).

Field whitelisting is structural. For analytics and diagnostics the server reads only the named fields and truncates each to 64 characters (String(b.event ?? "").slice(0, 64) etc. in worker/src/endpoints.ts); there is no code path that stores a free-form body. Aggregate counters are written to KV with an auto-expiry TTL of 60 * 60 * 24 * 90 seconds (90 days). See expirationTtl in handleAnalytics/handleDiagnostics.

Metadata-only logging. For the LLM route, the only thing recorded is the metadata struct LogRecord (worker/src/log.ts): model, feature, auth kind, an 8-character id prefix, HTTP status, elapsed ms, and an optional integer token total. There is no field for a body, prompt, header value, or query string, so content cannot be logged even by accident.

Two bypass paths

Neither of these touches Noesa's proxy or any endpoint above.

• Bring Your Own Key (BYOK). Set your own OPENROUTER_BASE_URL and OPENROUTER_API_KEY (read by desktop/app/Sources/NoesaKit/Synthesis/ProviderClient.swift). The desktop app then talks directly to the OpenAI-compatible endpoint you chose, with your key. Noesa's infrastructure sees nothing.
• Local model / Offline. Point BYO-endpoint at a local OpenAI-compatible model (e.g. Ollama at http://localhost:11434/v1) so inference stays on your machine; or flip the per-session Offline toggle, which hard-stops every outbound LLM call and uses the on-device deterministic rollup. Either way nothing egresses off-device at all.

Verify it yourself (OS-level)

You do not have to trust this document: you can watch the sockets. With the app running (start a session and trigger a synthesis so cloud AI actually fires), you should see connections only to:

• the Noesa proxy Worker host your app is configured to use; and
• in BYOK mode, the endpoint host you configured instead; or
• with BYO-endpoint pointed at a local model, only that local host (e.g. localhost:11434), with nothing off-device (with Offline on, no LLM connections at all).

Note the proxy's own onward call to the upstream provider (OpenRouter) happens server-side, on Cloudflare (not from your machine), so you will not see the provider host in your local capture unless you are in BYOK mode.

macOS

# Live per-process socket throughput (find Noesa's pid first, e.g. via Activity Monitor):
nettop -p <pid>

# Snapshot of the process's current network endpoints:
lsof -i -nP -p <pid>

For an outbound firewall with per-connection prompts and a persistent log, use Little Snitch (or the open-source LuLu): you will be asked to allow each destination host and can confirm the list matches the two/three hosts above.

Windows

• Resource Monitor → Network tab → filter by the Noesa process to see its live TCP connections and remote addresses.
• Fiddler or Wireshark to inspect the actual requests/hosts (note HTTPS bodies are encrypted; you are verifying destinations, and can confirm no image data is uploaded by size).

If you see traffic to any host other than the ones listed above for AI, licensing, or telemetry, that is not this codebase. Please report it.

Screenshots and pixels never egress

This is stronger than "screenshots don't leave the device": nothing off-device ever consumes a screenshot, so there is nothing to leak.

• Perception is on-device OCR plus a deterministic idle/active tag, with no vision model, cloud or local (docs/goals/native-ui-trust-backend-decisions.md, "Vision model already removed"; .env.example notes per-frame perception is model-free).
• No endpoint accepts an image. The only endpoint that transmits your content is the LLM route (row 1), whose body is the derived-text chat payload. The proxy declares which model is allowed via MODEL_ALLOWLIST (worker/src/config.ts), a text model only.
• Screenshots are used solely for on-device OCR and local evidence replay; only derived text (signals/OCR snippets for synthesis, redacted titles/intent for attribution) ever leaves the device, and only via the opt-in cloud AI path.