Data, egress, and privacy

PathWise runs on your machine. Investigation text leaves it two ways: the reasoning call to the model you chose, over your own key, and an optional webhook you configure yourself. A local model keeps the reasoning step on your own hardware.

What stays on your box

PathWise is a self-hosted tool. It runs as a container on a machine you control, whether that is a laptop or a VPS you manage. Every probe result, every file you hand it, and the diagnosis it writes stay on that machine unless you choose otherwise.

The container itself is hardened: it drops nearly every Linux capability, runs as a non-root user, and mounts a read-only root filesystem. See Security posture for the full picture.

The calls that can leave your box

Four kinds of traffic can leave the machine during an investigation, and you set up each one.

• The model call. PathWise reasons about your investigation with a large language model. Only the text it needs to reason about your ticket goes to the provider you configured, over your own API key. Nothing else about your network, your files, or your other credentials rides along. See the reasoning engine and bring your own model.
• Probe traffic. During an investigation, PathWise contacts the targets you asked it to check: DNS lookups, pings, HTTP requests, traceroutes. That traffic goes to the targets tied to your ticket, not to Silo7. The Environment panel in Settings can restrict which targets are allowed.
• A module's live connection, if you configure one. A module can declare a vendor API or MCP door. Configure it in Settings, under Modules, and PathWise makes an authenticated read against that vendor system during an investigation. The traffic goes to the management server you named, not to Silo7. Of the modules we ship, only Check Point declares a live door, and it falls back to reading an exported file when you store no credential. Store nothing and the call never happens.
• The completion webhook, if you set one. With an Engine webhook configured, PathWise POSTs an investigation summary to that URL after a run finishes or fails. Leave the field blank and this call never happens.

These are the calls tied to running an investigation, and today the engine makes no other outbound connection: it does not contact Silo7 in order to run. If a future version does, for an update check or product diagnostics, the privacy policy will describe it before it ships and it will be something you can control.

You pick the model provider in Settings: one of five frontier presets, your own OpenAI-compatible endpoint, or a local model through Ollama, which keeps the reasoning step on your own hardware.

Where your key lives

Your model provider key is stored encrypted at rest on the machine PathWise runs on, with the encryption key held in a separate file that only the account running PathWise can read. Anywhere PathWise displays the key back to you, it is masked. Each provider you connect keeps its own stored key, so switching engines does not mean re-entering credentials. See Security posture for how the encryption works.

What PathWise does not do

• It never applies, runs, or executes a change on your network. See Diagnose, never remediate for that guarantee.
• It keeps a local audit trail of every operation it runs, written to your own data directory. What Silo7 itself receives is described in the privacy policy, which is the binding text. See the audit log.

If you want the reasoning step fully local

Pick the local tier in Settings and run PathWise against a model through Ollama. The reasoning step then stays on your own hardware, and hosted model-provider traffic goes away. Probe traffic to your investigation targets remains, and a configured webhook still fires. Clear the webhook URL for a box that talks only to the targets it probes. See Run it locally with Ollama.