CryogramSecurity and data handling
Cryogram runs on your own computer, using your own AI subscription or keys, without a Cryogram account. This page explains what it stores, what leaves your computer and what you control. The source is available on GitHub.
What stays on your computer
Cryogram stores workflows, settings, chat, build materials, test results and run history in your application data folder, separate from the installation. Saved results and snapshots can contain data from your files and connected systems, so a stopped run can continue without starting over. Browser workflows also keep a local browser profile so you can stay signed in.
Your documents and records remain in the files and systems you work with. Cryogram may keep local copies in its own folder used when building or testing, but they are still on your computer only. Secret values are encrypted separately; the rest of the application data is stored as ordinary local files and a database.
What your AI provider sees
Anything used by the AI agent when building a workflow is sent to your AI provider, like any other project you use it for. This can include your messages, sample data, code and test results. It goes to the provider used by Claude Code or Codex under your own subscription or API agreement.
Once a workflow has been built, the agent does not see its run data unless you choose to share it, for example by asking it to investigate an issue. An AI step within a workflow sends its prompt and inputs to the model configured for that step when it runs. Steps that do not use AI make no model calls. You can use dummy data and test environments for the build. You can ask Cryogram to make endpoints, access keys and folder paths configurable in the Inputs tab, so you can switch from test to real data after building.
How secrets are handled
Secrets such as API keys are stored encrypted, so the AI agent can see their names, but never their values; the workflow uses them when connecting to the services they are for. When asking you to provide secrets, it will provide a box for you to enter them into rather than a chat - this means it can never see the values.
Use that box rather than pasting a secret into a message. Cryogram supplies the value when the step connects to its service and scrubs known secret values from returned outputs and logs.
The secret store uses AES-GCM encryption. Its key normally lives in the macOS login keychain or is protected by Windows for your user account. If that protection is unavailable, Cryogram falls back to a local key file, so protecting your computer and its backups matters too. Moving the application data folder to another computer may mean entering your secrets again. If the encryption library is missing, Cryogram refuses to save a new secret.
Connections and permissions
Workflows can send data to the services they use, through APIs, databases, websites and other connections. During a build, Cryogram asks before connecting to a new address, accessing a folder you have not allowed, opening a browser window or sending something for real. An address or folder you approve stays allowed for that workflow; permission to skip repeated browser or send questions during a build ends when the build finishes.
During a run, a step that sends, posts or writes to another app asks for approval unless you turn off Require my approval before this runs for that step. A website may record a visit even when the browser is only reading it.
Limits on workflow code
Steps have specific types for local code, user input, connections, browser actions and AI calls. Cryogram runs step code in a separate process, with checks on file access, network connections and starting other programs. File access is limited to working folders, required system files and folders specifically given permission to be used for the workflow. Direct access to Cryogram's private data and other workflows is refused. Network connections are checked against the workflow's allowed addresses, with local connections also permitted, and step code cannot normally start another program. Cryogram itself starts the browser for browser steps.
These checks prevent ordinary mistakes. They run inside the same process as the step code, rather than in an operating-system sandbox or container, so they are not a security boundary against deliberately malicious code.
The AI agent's configuration
Cryogram normally uses its own Claude Code or Codex configuration folder, keeping the builder separate from your personal projects, settings and chat history. With a ChatGPT sign-in, it links to your existing Codex sign-in file. If Windows does not allow that link, it falls back to your existing Codex folder, so the same separation does not apply there.
Checks, stopped runs and fixes
Cryogram tests steps while building and adds checks for their inputs and outputs. If you decline a live test, the step can still be built, but it is not tried for real until you run it. When a check fails during a run, Cryogram records the problem and keeps the data needed to continue. For a partially completed list, you can decide how to handle the failed and successful items.
You choose whether to ask the agent to investigate, then review its proposed fix. Changes are tracked in Information > Version history. If a send was not confirmed, check whether it arrived before repeating it; a stopped run cannot undo something already sent to another system.
Downloads and update checks
Installation and setup download the software and dependencies Cryogram needs. Provider setup can contact providers to load available models, and testing a provider makes a real request. The app can also check GitHub for a newer release without sending your workflow data. You can turn off automatic update checks under Admin > Preferences > Check for app updates when Cryogram starts. The check shows an update notice; it does not install the update for you.
Optional problem reports
Cryogram does not automatically send problem reports. You will be asked if you want to send one if a workflow stops due to an error, and you will be shown the full report before choosing Yes, share it or No. You can turn off these offers completely under Admin > Preferences > Offer to send a problem report. They are never sent without an explicit approval from you per report.
A report includes the app version, the error, the failing step's code and prompt, the workflow's structure and the shape of the failed output. It excludes the chat, saved variable values and run input fields, and scrubs known secret values. Names, code, prompts and error messages can still contain information about your work, so review the preview before sending it. Cryogram adds no account or installation identifier to the report.
Reporting a security problem
Write to hello@cryogram.app rather than opening a public issue, so the details can be investigated before they are made public. Include what happened and how to reproduce it, without sending passwords, API keys or private business data.