Your data & access

The source of truth

Plans and recorded decisions are stored in a private GitHub repository in your account. Changes form a versioned history that you can inspect with Git.

The hosted service also maintains a retrieval index, including indexed facts and embeddings, so it can find relevant context. “Git-backed” describes the source of truth; it doesn’t mean the hosted service never processes or indexes your data.

GitHub permissions

During setup, select the private memory repo for the GitHub App. The core memory store needs repository contents access for reading and writing plans and decisions.

Recording linked PR events from a product repo is a separate integration setup. Don’t assume access to the memory repo also grants access to your product repo. Review the GitHub App’s requested permissions and selected repositories during installation.

New spaces currently require the GitHub owner or organization to be approved. Members of an active space sign in with their GitHub identity.

Authentication

Coding clients connect to the hosted MCP service using OAuth. Hook authentication uses the CLI login and the OS credential store. Don’t put access tokens in project files, commands committed to Git, or shared documents.

The desktop app asks the CLI for a token and keeps it outside the webview. The app reuses your Wayform login.

Local agents and chats

Your coding agent runs in your environment. Planning-chat transcripts stay in the app’s local data directory; plans you save and decisions you record enter the shared service and memory repo.

Your chosen coding agent and model provider have their own data handling. Local execution of the agent process does not mean its model runs locally.

Team access

An admin can invite a teammate by GitHub username or revoke their space membership. Each member uses their own OAuth login; nobody needs to share an API key.

The current product supports one Wayform space per GitHub user. A space can hold multiple projects. Project names select which plans and context your agent is using.

Review connected sessions

Ask your agent:

List my Wayform sessions.

The session list shows connected clients and identifies the current session. To disconnect one, ask the agent to revoke its session ID. Revocation is scoped to your own account; removing a teammate is an admin action.

Know the boundaries

• Members’ recorded content can enter teammates’ agent sessions. Treat space membership as a trust boundary.
• The guard can surface contradictions with recorded decisions. It is not a security sandbox.
• Hooks fail open on runtime errors. Verify the setup with diagnostics instead of relying on silence.
• The current app build is unsigned. Obtain it through your approved access setup and verify its source.

This page describes product behavior. It is not a certification or a promise of zero data processing.