What stays local and what doesn't
The factory's own files stay on the machine that runs it.
The factory's own files stay on the machine that runs it. What an agent step reads can leave, because that step calls the model provider you configured. Telemetry stays off until you turn it on.
The factory's data folder
Each factory is one kusaw.yaml plus one data directory. The default folder is .kusaw beside kusaw.yaml. It holds the database, runs, worktrees, and specs. The registry only stores where those files live. Relative paths in kusaw.yaml are resolved beside that file.
Worktrees
A run gets a worktree per repository it touches, under the data directory. A step is meant to edit that worktree. Delivery is a local commit on a branch in that worktree. The factory does not push. With sandbox off, the process can still reach paths outside the worktree. With sandbox.mode: required, writes stay in the worktree, artifacts, and a private temp folder. See What a step can reach and OS sandbox.
What an agent step sends
An agent step sends the code and text it reads to the provider for that step. By default that is the Claude Code you already configured. If you enable Cursor and pick it for a step, that step sends what it reads to Cursor's service. The factory does not ask for credentials or a model. Treat it as you would any other session of that tool: if the step can read a file, that file can go to the provider.
Telemetry
Telemetry is off until you turn it on. Nothing is sent before that. There is no built-in destination. When you enable it, the only level is metadata: run and factory ids, outcomes, costs, hashed repository ids, and similar fields listed on that page. Task titles, spec text, diffs, logs, prompts, and file paths are not sent. The token and signing key are read from environment variables named in kusaw.yaml; those values are never written into the file.
Anonymous usage and error reports
Separate from telemetry, Kusaw can send first-party anonymous usage and error reports to kusaw.com. They are off until you opt in from the Dashboard banner, Settings, or kusaw reporting on. They carry only fixed categories and a random install ID, never code, paths, names, or arguments. KUSAW_REPORTING=off or reporting.disabled: true turns them off on this machine, whatever the other settings say. Manage them with kusaw reporting; kusaw reporting preview prints a pending error report exactly as it would be sent. The Dashboard's “What we collect” link opens the full collection note.
Connectors
Connectors are user-declared MCP or command programs the factory talks to as a client. Intake items and tool results are fenced as untrusted connector:<name> data. Log-store context is redacted (secret-looking values, bearer tokens, keys in URLs, email addresses) before it is cut and fenced. Secrets in connectors.<name>.mcp.env reach only that stdio process; secrets in mcp.headers reach only the broker's HTTP requests to that URL. They never appear in a step, agent session, custom step, proxy, log, or event. Write-back tools are outside effects held at the human gate. Agents call listed read tools through the per-attempt factory-connectors proxy. See Connectors.