Your data stays under your control
Screenpipe is local-first. Screen, audio, and activity are captured, processed, and stored on your own devices. The source is available, so your team can inspect the capture and data-flow code directly.
Local-first by default
Capture stays on the device: SQLite and media files under ~/.screenpipe. Nothing leaves unless you turn on sync.
You own the data
No Screenpipe servers in the core path. Local-first means data control, and liability, sits with you, not us.
Encrypted at rest
Sensitive data is encrypted with a zero-knowledge key hierarchy. The keys are yours.
You choose what is captured
Filter by app and by URL, strip passwords and PII. Per person, opt-in, never silent.
Source available
Audit the capture, encryption, and access-control code directly.
Deploy your way
Local-only for sensitive workflows, or a managed MDM rollout with locked admin policies.
the detail
what leaves your deviceCapture and storage are always local. AI is the only egress path, and you pick the mode.
- What leaves
- Nothing. Inference runs on the machine, against the local database.
- Who can see it
- No one outside the device.
- Trade-off
- Good for search, recall, and summaries. Team-wide process mapping and SOP generation are heavy and can exceed what a small local model handles well.
- What leaves
- Only the context for each request, sent to the provider you chose, under your own account.
- Who can see it
- Your provider, under your contract with them. Screenpipe is not in the path.
- Trade-off
- Full model quality. Your provider's retention and training terms apply, not ours.
- What leaves
- Only the context for each request, sent to Screenpipe and then upstream.
- Who can see it
- Screenpipe in transit. We do not retain your screen content and we do not train on it.
- Trade-off
- Full model quality with no setup.
what to exclude, and what to leave onA starting profile for support, IT, and managed service teams working inside other people's systems.
Exclude by application and URL pattern rather than by browser. Dropping a whole browser removes most of the value, because that is where the work happens.
On-device redaction runs underneath these rules. Passwords, keys, and card numbers are stripped before anything is written to disk, so a gap in an exclusion list is not a silent leak. How the privacy filter works.
if you hold data for clientsWhere the processor boundary sits for agencies, MSPs, and professional services.
Custodians of someone else's data need more than "you own the data". In local mode Screenpipe never receives client content, so we are not a processor for it at all. Hosted AI and Enterprise sync are the only paths that make us one.
Enterprise archives write to a bucket you own, with credentials you hold. Read the data processing agreement before enabling either, and ask about a BAA if you handle PHI.
what our shut-off can and cannot doIf your subscription lapses, what you lose is our query layer, not your data.
Enterprise deployments can archive to your own S3 bucket and query it through a gateway you run. That gateway checks every request against a signed access policy from our control plane, cached for 1 hour and refreshed every 5 minutes. So if your subscription lapses or we suspend your account, your own bucket becomes unqueryable through our software within about an hour. Seats are enforceable, and that is what enforceable means. We would rather write it down than have you find it during an incident.
What it does not touch: the bucket is yours and we never held credentials that could read it. The objects are newline-delimited JSON, readable with your own credentials and any S3 client, with no Screenpipe component involved. Capture keeps running. You lose our query layer over your data, not the data. The policy signing key can be pinned out of band so you can verify what we sign.
Read the full policy-window behaviorcomplianceWhat we can actually show you today, stated as attestations and programs rather than badges.
Current status, subprocessors, and questionnaire requests live in the trust center.
check this yourself
Do not take our word for it. Send these claims to an AI with the questions a reviewer in your position should be asking, or copy the prompt and use your own model.
evaluation prompt
Paste this into any AI chat to pressure-test whether Screenpipe fits your environment. Works with ChatGPT, Claude, Gemini, or any model with web access.
Need the full technical detail?
Architecture, cryptography, data flows, and source links for security review.
Found a potential vulnerability? Read the vulnerability disclosure policy before testing or reporting it.
