Privacy Policy
What leaves the machine.
VeriCommand's governance core runs entirely on your computer. Network access is limited to features you explicitly invoke, including sign-in, Pro operations, checkout, and update checks. The statements below are tied to the shipped behavior, not marketing assumptions.
The free core stays local
The governance core — packets, dispatch, the hash-chained record, HOLD, liveness, and prior-art checking — is files on your local disk. The modules that implement it contain no networking code (verified by a static source sweep), and the core operations were run under a test harness that turns any network attempt into a hard failure — the guard never fired (runtime probe). The board and chain never leave this machine unless you enable a hosted feature described below.
- No account is required to run the core.
- The free core does not contact an entitlement server and cannot be disabled remotely.
- VeriCommand has no crash reporter or behavioral telemetry. Update checks run only when you ask for one; updates are never silently downloaded or installed.
What can leave, and exactly when
Every network path in the product is off by default and requires an explicit action by you to exist at all:
| Path | Fires when | Default |
|---|---|---|
| SSO sign-in (Google / Microsoft) | You click sign-in | Signed-out — local mode works without it |
| AIREC governance services (enforce / verify / context-mesh) | You set the API base + token | OFF — absent config, does nothing |
| Auto-audit (second-model review) | You enable it in Settings | OFF — a missing setting reads as disabled |
| Pro drift compare (independent second-vendor review) | You submit a comparison while signed in to an account with an active Pro entitlement | OFF — never runs from the free core or without your request |
| Pro checkout and entitlement (Stripe) | You request checkout or use a hosted Pro operation | OFF — no billing request exists until checkout; entitlement is checked only for hosted Pro |
| Transactional email (Resend) | A qualifying billing, account, or support event requires a message | OFF — no email is sent from ordinary free-core use |
| Release update check | You click Check for updates | OFF — no automatic background download or installation |
| Automation webhooks | You write a webhook config | No-op without it |
| conductor CLI | You invoke it | An HTTP client by design; the offline surface is the MCP server, not this CLI |
| Hosted web app (app.ai-flightdeck.com) | You choose the hosted shell | Online by definition; the desktop app does not require it |
What the free core never transmits
Your agent prompts, your agents' responses, and your repository content are never transmitted by the free core. The only component that can carry derived work product off the machine is auto-audit — which you enable and can switch off. Automation webhook payloads are metadata and hashes only, HMAC-signed, and exclude agent content by construction.
When you enable hosted features
If you sign in or configure hosted governance, we process — as your service provider — only what those features need:
- Identity: the email address and name your identity provider (Google or Microsoft) returns at sign-in, used to authenticate you.
- Credentials you configure: API tokens you enter, used only to reach the services you pointed them at.
- Governance records: the chain records work about work — task titles, states, hashes, timestamps, and agent names. You choose what goes into packet text; we recommend keeping sensitive identifiers out of titles.
We use this data only to provide the features you turned on. We do not sell it, and we do not use your content to train models.
VeriCommand Pro: drift compare, billing, and account entitlement
Pro drift compare is intentionally not a zero-egress feature. When you request a comparison, VeriCommand sends the recorded decisions and the agent return you selected to NorthGate's AIREC endpoint. The endpoint sends that comparison prompt to an available model vendor other than the primary agent's vendor so the review is independent. The application does not store those decisions or that agent return after the request; it records a metered usage count and operational error information. The selected model provider processes the submitted content to produce the comparison under that provider's applicable service terms.
- Stripe processes checkout, subscription status, and payment-related information. VeriCommand does not receive full card details.
- Account entitlement is checked by NorthGate when a signed-in user requests a hosted Pro operation. Cancellation, failed payment, refund, or administrative revocation can disable hosted Pro access; none of those events disables the free local core.
- Resend processes the recipient email address and transactional message when VeriCommand needs to send an account, billing, support, or compatibility notice.
- Legacy signed licences may be accepted during the transition to account-based entitlement. They are a compatibility path, not the primary activation model.
Update checks
VeriCommand does not silently update itself. When you click Check for updates, the desktop contacts NorthGate's release feed to read current version metadata. If a signed update is available, you choose whether to download it and whether to restart and install it. The updater validates the publisher signature through the signed installer path; an update check does not transmit your board, prompts, agent returns, or repository content.
This website
- Early access: if you give us your email, we store your email, a timestamp, and the page you came from, solely to contact you about availability.
- Hosting: the site is served by Cloudflare, which processes standard request metadata (such as IP address and user agent) to deliver and protect the site.
- We run no third-party ad networks and no cross-site tracking, and we do not sell visitor data. Any visit metrics we keep are aggregate and used only to gauge interest.
How these claims are verified
The local-first statements above were verified against the shipped source on 3 August 2026 — a static sweep for network imports and a runtime probe under a socket guard, with method and limits recorded in an internal audit. The probe covered the core library paths, not every process end to end; a full session-length packet capture is named as open work. If this page and the code ever disagree, the code is the truth and this page is the defect — tell us and we will fix it.
Education deployments (FERPA)
On a lab machine running only the free core, student work, agent output, and the governance record stay on that machine — nothing to disclose, because nothing moves. The moment hosted features are enabled, records that may reference student work become data held by a processor, and a FERPA review should happen before enablement, not after. We state this so it is a planning input, not a discovery.
Your choices and contact
You can ask what data we hold about you, correct it, or have it deleted. Because the core keeps your governance data on your own machine, most of it is already in your hands; for the rest, or any privacy question, contact:
NorthGate Strategic LLC
[email protected]
Changes
If we change what the product or this site does with data, we will update this page and its effective date. Material changes to hosted features will be called out, not buried.