This page says what Strata downloads, where from, when it uses the internet, what stays on your PC and how the downloads are checked. Everything here comes from reading the code of this version. Each section names the files, so you or anyone you trust can check it. Where Strata does less than you might hope, the page says so.
- Your chats, prompts, files, pictures and models stay on your PC. They leave only when you choose it: you add an outside model service, you open the server to other devices or to the internet, or the agent searches the web or opens a page (see What the agent can do).
- There is no telemetry. Strata sends no usage data, no crash reports and no analytics, and has no account to sign in to.
- Starting and running a model never downloads anything. Downloads and updates are separate steps that you start.
- The server listens on your PC only. Reaching it from another device needs an API key.
- Once a model is downloaded, Strata runs without internet. Starting, loading, serving and chatting need no connection. Only things you ask for use it: the agent's web search and web pages, an outside model service, the tunnel, and installs and updates (a first model install also fetches llama.cpp's preparation scripts).
- Downloads are checked. Updates come from a signed feed. Every model file has a fixed SHA-256 and size, and an install stops if the pinned version of a file is gone (the details are below).
- The coding agent asks before it changes anything in its default mode. It does not ask before it searches the web.
- The code is open. Anyone can read it, and security problems go to SECURITY.md.
No. A search of the app, the Terminal, the engine server and the installers found no analytics library, no crash
reporter and no code that reports usage anywhere. The app's privacy notes say the same
(apps/host/src/components/PrivacyNotes.tsx: "Strata sends no usage telemetry").
Some things sound similar and stay on your PC:
- The Monitor,
/metricsand/v1/telemetryshow hardware readings (temperature, speed, memory) to you. They are served from your own PC, and they need your API key when you set one. - On Linux, when the app window crashes, a crash log is written to a folder on your disk. Nothing sends it. Save logs (Settings, Engine, Diagnostics) puts a text file in your Downloads folder, and you decide whether to attach it to a bug report.
- The coding agent is a separate component (the DeepSeek Harness, MIT). It has its own telemetry switch, and Strata starts it
with that switch off (
apps/host/server/agent/harness-runtime.mjs).
Like any download, each connection below shows the other side your IP address and the file you asked for.
| What | Where it goes | When |
|---|---|---|
| Model files, the picture reader, the speed-up layer (MTP) | huggingface.co, or the mirror in HF_ENDPOINT if you set one |
When you install a model |
| The same files from ModelScope, for PCs that cannot reach Hugging Face | modelscope.cn | Only if you ask for it (--source modelscope). Strata never switches to it by itself |
| Engine, Terminal and Control updates | The signed feed on GitHub Releases of Niko1221/Strata | When you install an engine, press Update engine, or run strata update. Opening Settings, Engine in the app also reads the feed to see whether an update exists |
| App updates | latest.json on the same GitHub Releases, through Tauri's updater |
When you press Check for updates or Update Strata, and when you open Settings, Engine |
| llama.cpp source code (a fixed commit) | github.com/ggml-org/llama.cpp | During a model install, if it is not on your PC yet. Strata uses only its model-preparation scripts |
| Web search and web pages | DuckDuckGo, with Bing as the second source; or Exa, Perplexity or DeepSeek if you save a key for them. Any page the agent is asked to open goes to that page's site | When the agent uses its search or "open web pages" tool |
| Outside model services | The service you add (OpenAI, Anthropic, OpenRouter, a server on your network and others) | Only for chats with that model, and only after you add its key |
| Cloudflare tunnel | Cloudflare, through the cloudflared program |
Only while you have the tunnel on, and it will not start without an API key |
| Tailscale, local network | Not Strata's traffic. Strata only reads Tailscale's status and shows the address | Only if you choose that access in strata launch |
| An image link in an API request | The address in the link | Only when a program sends your server a request with an http(s) image link. --offline refuses it |
| Remote tool servers (MCP) | The address you put in the run config | Only when you add one |
| A website you open in the app's preview pane | That website | Only when you type an address into Open a website |
| Share to X or Reddit (Monitor screenshot) | Your browser opens x.com or reddit.com with a caption and a link to the Strata page | Only when you click it. The screenshot is saved to your disk, not uploaded |
That is the full list found in the code. Some details:
- Nothing checks for updates in the background. The app does not check when it starts. The checks in the table run when
you open Settings, Engine, press a button or run a command. The Terminal fetches an engine by itself only when none is
installed, and
strata launchasks first. - Starting and serving never download.
strata serveand the app's load button fetch nothing. The app setsSTRATA_PACKAGED=1andSTRATA_NO_ACQUIRE=1for its parts (apps/desktop/src-tauri/src/main.rs), and the downloaders refuse to run under them (strata_control/acquisition.py,apps/host/server/acquisition.mjs). That is why the app never downloadscloudflaredfor you while it runs. - The engine itself has no network code. The part of Strata that runs the model (
src/,include/,sycl/,metal/) contains no networking. The app's own pages load no fonts, scripts or trackers from the internet. - Building from source reaches more places. Python from python.org or winget (
START-HERE.bat), a standalone Python from GitHub on a Mac (setup.sh), Python packages from PyPI (requirements.txt, pinned versions), NVIDIA's CUDA libraries from PyPI and, on Ubuntu and Debian, NVIDIA's apt key and packages, AMD's ROCm wheels, the Vulkan SDK from LunarG, and llama.cpp and stable-diffusion.cpp source from GitHub. These run only while you run the setup.
- Chats, prompts, attached files and pictures are handled by the engine on your PC. The app keeps chats in its own storage on your disk. Models are in the folder you chose.
- API keys you save for outside services are kept in a file that only your user account can open. They are not
encrypted. (
apps/host/server/model-providers.mjs) - The server listens on
127.0.0.1, this PC only. The app fixes that address (STRATA_BIND=127.0.0.1), and the engine server's default is the same (serve/server.py, the--hostoption). - Sharing needs a key. The app's "Share with other devices" and the Cloudflare tunnel will not start without an API
key, and the shared port answers only
/v1/models,/v1/chat/completionsand/v1/messages(apps/host/server/local-share.mjs,cloudflare.mjs).strata launchmakes a key for you when you pick anything wider than this computer. The bare engine server (serve/server.py) only prints a warning if you open it to your network without a key, so set one yourself in that case. - When you use an outside model, the conversation (and the instructions of skills you switched on) go to that service. The app says so in its privacy notes. The service's own rules then apply.
- Programs you connect (Claude Code, Codex, and so on) are separate programs with their own network behaviour. Strata does not control what they send.
The server also has browser protections (a host check, an origin check, no CORS by default). They are in SECURITY.md.
Updates for the engine, the Terminal and Control.
- The release publishes
strata-feed.jsonandstrata-feed.json.sig, signed with an Ed25519 key. The matching public key is inside every installed Strata (strata_control/update_keys.json). The private key is kept offline by the owner. - Before it uses the feed, your PC checks the signature, that the feed has not expired and that it is not older than the last feed it accepted (so an old feed cannot be replayed).
- Each engine package is checked against its SHA-256 and its signed manifest, then every file in it against its own hash, then it is checked to fit your PC.
- The new engine is test-started before Strata switches to it. If anything fails, you keep the engine you had.
Updates never replace your models or saved tuning. The full description is in packaging/UPDATES.md.
The app. Its updates are signed with a separate key (Tauri's minisign), and the public half is in the app
(apps/desktop/src-tauri/tauri.conf.json). The updater refuses an installer whose signature does not match. The Terminal
checks the same signature when you run strata update --app.
Model files. Every model file that setup.py downloads has a fixed SHA-256 and size, written in the code, so the check
needs no network: the main Qwen3.8-Flash-Next files (Q2_0, IQ2_XS, IQ3_XXS, IQ3_S), Swift 1.5, the Coder, the Unsloth sizes,
the Gyro files, Qwen3.6, the NVFP4 packs, the picture reader, the image model files and the speed-up layer (MTP, tensor by
tensor). A file that does not match is deleted and the install stops. A file whose size on the server is not the pinned
size stops it before the download starts.
- If the pinned version of a file is gone from Hugging Face, the install stops and says to update Strata. It does not take
the repository's current file instead. A tester can set
STRATA_ALLOW_UNPINNED=1to take the current file anyway, without the check. It is off by default, and setup says so when it is set. - Starting a model does not check its files, and running setup again for a model you have does not download or hash them again. A file installed before these hashes existed is kept as it is.
- Files from ModelScope are checked against the same fixed SHA-256. ModelScope serves a repository's current files, so a file it has changed fails the check. A file without a pin is checked against the hash ModelScope publishes, and setup warns when it publishes none.
- The app installs these models by running the same setup, so it has the same checks. The app's host also keeps a short
starter list of its own (
apps/host/server/real-model-catalog.mjs). Its download path takes files from the repository's currentmainbranch and checks only that they have about the expected size. The 0.2.0 app screens do not use it. (setup.py:REPO_PINS,download,verify_sha256;tools/mtp_fetch.py;apps/host/server/image-models.mjs.)
Engine in the source route. setup.py checks the engine zip against the SHA-256 that GitHub's API publishes for that
release file. If GitHub cannot say (offline, rate limit), setup warns and installs anyway. STRATA_SKIP_SHA256=1 switches the
check off, and it is never on by default.
The one-line install (curl ... | sh, irm ... | iex) checks the Terminal archive's SHA-256 and the signed feed with the
Terminal it just unpacked. The checksum and the key come from the same release as the archive, so the first install trusts
HTTPS and the Niko1221/Strata release itself. What that means, and how to read the script first, is in
SECURITY.md. Later updates are checked against the key already on
your PC.
Code signing. The Windows installer is not code-signed yet, so Windows shows "Windows protected your PC". The signing and
Apple notarisation of the Mac builds is set up in packaging/mac/ and runs on the maintainer's Mac. A Mac build that has not
been notarised shows macOS's "damaged" warning (MAC.md).
What the checks do not cover. They catch a damaged or swapped download and a feed nobody signed with the release key. They cannot protect you if someone who can publish a release (or who holds the signing key) publishes something harmful.
The app's chats run through an agent that can read files, run commands, edit files, search the web and use tools you
connect. What it may do without asking depends on the Mode menu (apps/host/server/agent/README.md).
| Mode | What happens |
|---|---|
| Manual (the default) | Anything that changes something asks first, with one Approve or Deny card, before it runs. |
| Plan | Nothing can change. A request to change something is refused, and no card appears. Tools you connect are refused too. |
| Bypass | Full access, no questions. |
In Manual:
- These ask: writing or editing a file, any command that is not on a short list of look-only commands, and every tool you connect. In the browser tool, opening a page, clicking and typing ask.
- These do not ask: reading files, listing and searching folders, and look-only commands such as
ls,catandgit status. A command with a redirect, a chain (;,&&), a variable or anything else the check does not recognise asks. - Web search and opening web pages do not ask. They are on by default and can be switched off in Settings, Tools. The
model picks the search words and the address, so words from your conversation can end up in a search or a web address
(
strata-gate.mjslists both as read-only). - The chat folder is only where the agent starts. Manual mode does not confine it there. What you approve can touch anything your user account can touch, so read the card before you press Approve.
- Your keys stay out of its commands. The agent's shell does not get environment variables whose names contain KEY, TOKEN, SECRET, PASSWORD, CREDENTIAL or AUTH.
- Scheduled tasks run in Plan mode by default. With nobody at the screen, a request for approval is answered "no".
- Stop ends a chat's run. Closing a tab does not.
The agent runs on a loopback address with a random token, so other programs on the network cannot reach it.
Strata is MIT-licensed and the whole code is at github.com/Niko1221/Strata. Read it, build it and compare. Strata has not had an outside security audit yet.
To report a security problem, use GitHub's private reporting (the repository's Security tab), as described in SECURITY.md. Ordinary questions and ideas can go to an issue.
| Topic | Files |
|---|---|
| Model downloads and pins | setup.py, tools/mtp_fetch.py, tools/image/qimage.py, apps/host/server/models.mjs, image-models.mjs |
| Update feed, signatures | strata_control/feed.py, signing.py, transfer.py, update_keys.json, strata_cli/update_cmd.py |
| App updater | apps/desktop/src-tauri/src/updater.rs, apps/desktop/src-tauri/tauri.conf.json |
| Downloads refused while running | strata_control/acquisition.py, apps/host/server/acquisition.mjs |
| One-line installers | packaging/install.sh, packaging/install.ps1 |
| Web tools and the agent's approvals | apps/host/server/agent/plugins/strata-gate.mjs, agent/profile.mjs, web-search-ddg.mjs, web-search-bing.mjs, web-search-keyed.mjs |
| Outside model services | apps/host/server/model-providers.mjs |
| Sharing, tunnel | apps/host/server/local-share.mjs, cloudflare.mjs, strata_cli/launch/access.py |