Local-first
by design.

What’s on your machine

Bond is a desktop application. Your workspace lives on disk where you installed it. That includes:

• Every teammate’s identity, system prompt, and conversation history
• Every memory entry — facts, decisions, glossary — and the provenance link back to the conversation that produced it
• Every document you’ve pinned to the library
• Every sync brief, meeting transcript, council session, and task result

Bond’s servers do not host any of this. There is no “cloud account” you can log into to see your workspace from another device, because we don’t have it.

Bring your own key

You provide your own API keys for the model providers you want to use.

• Keys are stored locally, encrypted with AES-256-GCM via your operating system’s keychain (macOS Keychain or Windows Credential Manager).
• Keys never leave your machine.
• When a teammate uses a model, the call goes from your machine directly to the provider’s API. Bond’s servers are not involved.
• You pay the provider at the provider’s published rate. Bond adds zero markup on inference.

The cost of running Bond is whatever your model providers charge you. We don’t see it, we don’t take a cut.

What model providers see

When a teammate makes a call, the model provider (OpenAI, Anthropic, Google, Perplexity) sees:

• The prompt being sent
• The model name being requested
• Your API key (as authentication)
• The completion they generate, on its way back

This is unavoidable — model inference happens on the provider’s servers. Bond does not see this traffic because it goes directly from your machine to the provider.

If you’re sensitive about what reaches a given provider, your two levers are:

1. Don’t enable that provider in Settings. Bond won’t call them.
2. Use a different provider for sensitive teammates. Each teammate is bound to one provider at a time.

What Bond’s servers do see

Bond’s servers handle two things, and only two things:

1. Licensing. When you sign in or refresh your license, Bond checks license.ai-bond.dev to confirm your subscription is active. The license service stores five fields and only five: your email, your Stripe customer ID, your plan type (monthly or yearly), your subscription status, and the date.
2. Software updates. Bond checks for new releases periodically. The update check is a standard HTTPS GET to a release server. No workspace content is sent.

No telemetry. No logging of prompts or completions. No error reporting that captures conversation content. No crash analytics that ship your data anywhere.

There is no “Bond cloud” that stores your workspace, mirrors your memory, syncs your teammates across devices, or trains any model on your data.

License and billing are separate from your workspace

License and billing live on a separate Cloud Run service at license.ai-bond.dev. It handles:

• Stripe checkout for Bond Pro
• Stripe Customer Portal (manage card, change plan, cancel)
• License validation when Bond checks in

It does not have access to your workspace data, because that data never leaves your machine.

If you cancel, your workspace is never touched and never removed. You drop to the Free-tier limits going forward, but every teammate, every memory entry, every conversation you’ve already built stays exactly where it is.

Export anytime

You can export your entire workspace at any time. The export is a portable archive of your teammates, memory, conversations, and library docs.

You own your data because it’s already on your machine.

MCP connectors

Bond can connect to MCP servers — Linear, GitHub, Anthropic’s own, and any other MCP-compatible service. When you enable a connector, Bond’s MCP traffic for that connector goes to that service.

This is opt-in: nothing is connected by default. You choose what Bond talks to.