Surfil

Zero-trace

Zero-trace means your source code never leaves the device. It is a hard architectural invariant, not a privacy setting you toggle - nothing in Surfil depends on your code being uploaded anywhere, so there is no mode in which it happens.

Why it exists

A control plane for coding agents sees everything your agents see: prompts, diffs, file contents. Trusting a vendor with that is a decision most teams cannot make - so Surfil is built so you don't have to. The device does the heavy work; the edge only authenticates, meters, and signs. That split is the zero-trace guarantee and the pricing model at once.

How it works

Three kinds of traffic cross the device boundary, and only three:

  • Signed, metadata-only telemetry - what ran, what it cost, what was blocked. Enough to show savings and activity; never file contents, prompts, or diffs.
  • Memory ciphertext - if Mind syncs at all, it syncs end-to-end encrypted. The server stores ciphertext it cannot read.
  • Signed batches over mTLS - for entitlement, metering, and receipt operations.

The edge workers behind api.surfil.com are stateless by design: they process signed metadata, not code. There is no server-side store your source could accumulate in.

What never leaves

Prompts, file contents, diffs, repository structure, and any other source material stay on-device. Before any string is added to a telemetry payload, the rule applied is: would this let someone reconstruct your source? If yes, it doesn't ship.

What it means for you

  • You can run Surfil on proprietary code without a vendor security review of "where does our source go" - it goes nowhere.
  • Dashboards and receipts are built entirely from metadata, so everything you see in the Hub is safe to share.
  • You don't have to take this on faith: outputs are signed and offline-verifiable, and uninstall removes everything byte-exactly.
Zero-trace constrains every product, including future ones. A feature that would need your source on a server doesn't get built that way - it gets built on-device or not at all.