FAQ

Short answers, each linking to the page with the full story. Grouped by theme: privacy, honest claims, Credits, compatibility, and what happens offline or on the way out.

Privacy

Does my code ever leave the device?

No. Prompts, file contents, and diffs stay on your machine - it's an architectural invariant, not a setting. Telemetry is metadata only, and memory syncs end-to-end encrypted. See Zero-trace.

What does Surfil actually send, then?

Three things: signed metadata-only telemetry (what ran, what it cost, what was blocked), memory ciphertext the server can't read, and signed batches for metering and receipts - over mTLS to stateless workers.

Claims and verification

How are savings calculated?

Measured before/after on your own traffic, reported in tokens (the unit where the measurement is a fact), as a conservative floor - never a fixed rate, a projection, or an invented dollar figure. See Cut costs with Cap.

Is Surfil "certified" by anyone?

No, and we don't use the word. Every claim traces back to a measured, Ed25519-signed fact you can verify yourself - including offline, without an account. See Signed outputs.

Can someone who isn't a customer check my receipt?

Yes - that's the point. surfil verifyworks with the public key, offline, on anyone's machine. See Verify a receipt offline.

Credits and billing

What is a Credit?

The metering unit: one server-signed value-output equals one Credit. Execution - the pipeline itself - is unmetered. See Credits.

Can a retried request double-charge me?

No. Every consume call carries an idempotency key and decrements are atomic - a duplicate is a no-op, by contract.

Compatibility

Which agents are supported?

Claude Code, Cursor, Codex, Copilot, and MCP-based agents - interception happens at the network boundary, so one install covers all of them. See Install for per-agent notes.

Will interception break my provider's prompt caching?

No. Passthrough is byte-exact - the provider sees identical prefix bytes, so your prefix cache keeps working. That's asserted in CI, not assumed.

Offline, and leaving

What happens if I'm offline?

Work continues: the runtime is on-device and buffers locally when it can't reach the edge. Already-signed outputs remain verifiable offline - see Verify a receipt offline.

What happens when I uninstall?

surfil uninstall restores every agent config byte-for-byte and leaves zero residue - verified behavior. Run surfil export first to take your Weave knowledge with you as a .surfilpkg; receipts inside it keep verifying after you're gone.