Local-first by design
cliq runs on your machine. Pipelines execute against your filesystem and your existing credentials. Nothing in your data, your artifacts, or your brief is transmitted to cliq's servers by default.
Model provider data flow
When cliq calls an LLM runtime (Cursor, Claude Code, Gemini, Codex, or a custom A2A agent), the data sent is governed by the agreement you have with that provider — not with cliq. You remain in control of which runtimes are enabled and which data they see.
Authentication
- CliqHub uses bcrypt for passwords and signed JWTs for session tokens.
- API tokens are hashed at rest and never displayed twice.
- The cliq server is protected by a bearer token bound to your machine.
Integrations
Tokens for GitHub, Bitbucket, Jira, and Slack are stored locally in ~/.cliqrc/settings.json, readable only by your user account. We recommend scoping them to the minimum permissions cliq needs.
Responsible disclosure
Found a security issue? Please email [email protected]. We aim to respond within 24 hours and fix high-severity issues within 7 days.
Compliance
We offer a SOC 2 report, custom DPA, and optional dedicated or self-hosted CliqHub deployments for organizations that need them. Contact us for details.