Free account. Local execution. No source upload.
Shipmoor runs analysis locally. Your source code and diffs are not uploaded by default. Shipmoor contacts its services for authentication, entitlements, command allowances, and features you explicitly enable.
What stays local by default
Normal authentication, entitlement, and allowance enforcement does not send source, diffs, prompts, findings, verdicts, evidence, file paths, repository names, branch names, test output, or acceptance criteria. Raw Free artifacts remain local.
BYO-agent features run under the provider relationship and configuration you explicitly choose. Review those provider data practices separately; enabling a provider-backed feature is not part of Shipmoor’s default service-contact path.
Required service contacts
Every installation requires account and device authorization. Normal service contacts may include:
- opaque account and device identifiers;
- CLI version and platform;
- command-family key;
- a random invocation idempotency key;
- invocation source (
cli,skill,harness, oride); and - timestamp.
Free Claim Check, Review, Test Evidence, and Blast Radius commands contact the allowance service before each admitted invocation. Unlimited Scan, Harness, and Skills can continue while a valid signed Free lease or grace period applies. Pro capabilities can continue while a valid Pro lease or grace period applies.
Credentials
Device refresh credentials are stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service. A restrictive 0600 local fallback may be used with a warning. Refresh credentials rotate and are device-bound. Signed entitlement leases may be stored in restrictive local files.
SHIPMOOR_TOKEN is used only for current self-managed Scan CI. Keep it in the environment; Shipmoor never copies it to disk or logs it. Request-body logging is disabled for allowance operations.
Stored allowance metadata
Usage events contain only opaque account and device identity, the random idempotency key, command key, source enum, and timestamp. They do not contain command output or project context. Unknown or source-shaped request fields are rejected.
Installation and updates
The universal installer and shipmoor upgrade contact the download service when invoked. Archives are verified against published SHA-256 checksums before installation or replacement. Pin SHIPMOOR_VERSION=0.10.0 for reproducible installations.
Roadmap boundaries
Team and Enterprise managed CI, shared policy, SSO/SCIM/RBAC, audit controls, compliance evidence, and private runners are coming soon or contact-only. They are not implied by the local CLI privacy contract.