Data and security

This page says plainly what Minga keeps, what leaves your machine, and what Minga does and does not stop. Read it before you let work run unattended.

What stays on your machine

• Your repo. Work happens in worktrees the runner adds from your own clone. Minga does not copy your repo to its servers.
• Your CLI setups and their credentials. Claude Code and Codex keep their own logins and keys. The runner checks whether a CLI is signed in without reading the credential files.
• Your git and gh logins, which runs use as they are.
• The runner’s own token, in ~/.config/minga/credentials with file mode 0600. It is never written to runner.toml and never logged.

What Minga stores

Minga runs on Cloudflare. For each workspace it stores:

• your account, the workspace, its members and invites;
• the plan: goals, KPIs, items, their specs and checks, the brief, cards and comments;
• every change as an event, so history can be replayed;
• the chat with each agent;
• outputs that workers, agents or people attach (files up to 25 MB, stored per project, never public, opened only through short-lived signed links);
• run transcripts.

Run transcripts

A run’s transcript is what the run read and did: the commands it ran, their output, excerpts of files it opened, and the diffs it made. The runner streams it to Minga as the run goes, so you and your team can follow the work. Every workspace member who can open the run can read its transcript. The runner removes its own Minga tokens from it. Don’t count on anything else being removed: if a command prints a secret, the secret is in the transcript.

What goes to model providers

• Runs use the Claude Code or Codex CLI on your machine, and the CLI sends your code and context to its model provider as it always does, under your own key or login. That provider bills you, not Minga.
• Lea’s turns in the cloud, if you choose that, send her context (the brief, the plan, the chat, what changed) to Anthropic or OpenAI with your workspace’s API key. Images from the last messages of the chat are passed to the model through links that expire after 15 minutes.

Connections

• Runners dial out. A runner opens one outbound WebSocket to Minga. Minga never connects into your machine.
• Runner releases are signed. minga update verifies each release’s SHA-256 sum and Ed25519 signature before it installs it. The install script checks the SHA-256 sum, and the signature wherever your OpenSSL supports Ed25519 (set MINGA_VERIFY_SIGNATURE=require to refuse an install it cannot verify).
• MCP clients sign in with OAuth. Your own Claude Code or Codex session signs in as you, after you press Allow. Access tokens last 15 minutes, refresh tokens 30 days, and codes go only to a local address on your machine. See Connect Claude Code and Codex over MCP.
• Model keys are stored encrypted per workspace, tested before they are saved, and never shown again. Owners and admins can change them; every member sees which providers are set up.

What is gated

• Minga’s own outward actions. Items that publish or send something always end at a person’s approval. Minga does not send them itself; approving marks the item done, and the outward step is yours.
• Changes to the plan, as far as Lea’s autonomy level says. The brief, a colleague’s items and the team’s shape are always cards.
• Permission prompts, as far as the profile’s access mode asks for them. In Ask, every edit and command becomes a card.

What is not gated

Runs use the stock Claude Code and Codex CLIs, with nothing added around them. Minga does not limit what a run may do beyond the CLI’s own permission mode and sandbox. In particular:

• A run can push, force-push, merge or close pull requests with your own git and gh credentials. Minga does not refuse it. Workers are instructed to open draft pull requests and that a person merges; that is an instruction, not a lock.
• A run can read what your user can read, depending on the CLI’s sandbox: CLI memories, transcripts of your other sessions, credential stores such as ~/.ssh or ~/.aws. What it reads lands in its transcript, where workspace members can see it.
• Your own instruction files (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md) and CLI settings load in Minga’s runs, on purpose: runs work the way your CLI is set up.

How to tighten it

You want	Do this
To confirm every edit and command	Set the profile’s access mode to Ask: minga profile set <id> access ask
No network for Codex runs in Auto	minga profile set <id> network off
Only Minga’s tools in runs, not your own MCP servers	minga profile set <id> mcp minga_only
To keep sensitive work apart	A separate profile (its own CLI home and login) on a separate machine or user account, with only the repos it needs
A profile to serve only some workspaces	minga profile scope <id> <workspaceId>
A hard local limit on what the runner takes	The runner’s policy ceiling, ~/.config/minga/ceiling.toml, which only you can raise on the machine. See Runner configuration.

To stop work now: stop a run, pause an agent, or stop the runner on the machine (minga runner stop).

Removing access

• A runner: minga runner logout on the machine, and revoke it in Settings › Runners. Owners and admins can revoke any runner in the workspace.
• An MCP client: Account (your avatar) › Connected apps › Disconnect. Access ends within 15 minutes.
• A person: remove them in Settings › Members. Their runners in that workspace are revoked, and their agents stop starting work until someone takes them over.

Note

This page describes how the product works. The policies are the privacy notice and the terms of use.