Security

What we can see — and what we can't.

Office Claws runs your agents on your own Contabo VPS and keeps most credentials on your machine. Most, not all: this page lists exactly what reaches our servers, what never does, and how to check it yourself.

Last reviewed: October 17, 2026 · CLI 0.2.10

How the pieces connect

Your machine
  • officeclaws CLI / desktop app
  • OS keychain: Contabo + Tailscale credentials
  • SSH private key
⇅ your Tailscale tailnet
Your Contabo VPS
  • Agent runtime (Docker)
  • Codex / ChatGPT sign-in
  • Firewall: tailnet-only ports
⇅ model calls
OpenAI
  • Codex, on your ChatGPT plan
⇅ HTTPS
api.officeclaws.com
  • Account & subscription
  • Agent metadata & gateway tokens
  • Chat history

Never reaches our servers

  • Contabo API credentials
    Client ID, secret, API user and password are validated by the CLI against Contabo directly and saved in your OS keychain. No Office Claws endpoint accepts them.
  • Tailscale auth key
    Saved in your keychain and passed to your VPS over SSH during setup.
  • SSH private key
    An Ed25519 key generated on your machine (~/.ssh/openclaw_id_ed25519, mode 0600). Only the public half is shared.
  • Codex / ChatGPT sign-in
    connect-codex runs OpenAI's sign-in on your VPS; the OAuth callback is caught on your own machine. Tokens live on the VPS.
  • Telegram bot tokens
    Written straight to your VPS over SSH.
  • Access to your VPS
    We hold no SSH key to your VPS, and our backend never joins your tailnet.

What our servers store

These live in our Postgres database. It is not encrypted at the column level today.

Account
Email, display name, bcrypt password hash, subscription status. Card details are handled by Paddle and never reach us.
VPS metadata
When you pick a VPS during onboarding, the CLI syncs the instance IDs and public IPs from your Contabo account, plus each agent's Tailscale IP and hostname.
Agent gateway token
The token the CLI and desktop app use to talk to your agent. We store it so you can reconnect from another device. Our servers can't reach your agent's port (tailnet-only), but we do hold the token.
Chat history
Messages you send through the CLI or desktop app, and the agent's replies, are saved to your account.
SSH public key
The public half of your Office Claws SSH key.
Usage analytics
Install pings and CLI command events (command name, ok/error status, duration, version, OS, a random install ID; linked to your account when you're logged in), plus website page views and clicks. Never arguments, flag values, error text or raw IPs. Details under Telemetry below.

Where model traffic goes

Before connect-codex

A new agent starts on a small starter allowance through the Office Claws LLM gateway (llm.officeclaws.com), so prompts and replies pass through our servers. The gateway records usage (tokens and cost); it isn't set up to store message contents.

After connect-codex

The agent switches to your own Codex subscription, and model calls go from your VPS directly to OpenAI.

What's on your VPS

  • ufw denies all incoming traffic by default. After Tailscale is up, public SSH is closed and only ports 22, 443 and 18789 are open, on the tailnet interface only.
  • SSH hardening: root login, password and challenge-response auth, X11 and agent forwarding are all disabled.
  • fail2ban and unattended security upgrades are installed.
  • The agent runs in Docker as the openclaw user, reachable only through your tailnet.
  • During a --reinstall, the VPS is briefly reachable over public SSH until setup closes it again.
  • No telemetry is sent from your VPS to us. The only Office Claws endpoint it calls is the LLM gateway, before you connect Codex.

Telemetry

  • Website: our own cookieless analytics counts page views, install-command copies and download clicks, with a visitor hash that changes every day. Google Analytics and Yandex Metrica load only if you click "Allow" in the cookie banner.
  • CLI: after each command it sends the command name, ok/error status, duration, CLI version, OS/architecture and a random install ID. When you're logged in, the event is linked to your account. Arguments, flag values and error messages are never sent.
  • Turn CLI and installer analytics off with OFFICECLAWS_NO_ANALYTICS=1 or DO_NOT_TRACK=1, e.g.: curl -fsSL https://officeclaws.com/downloads/install.sh | OFFICECLAWS_NO_ANALYTICS=1 sh
  • The desktop app checks for updates.

Verify it yourself

Don't take our word for it. These commands show what's stored where.

On your Mac: list Office Claws keychain entries
security dump-keychain | grep -A4 openclaw-office
On the VPS: firewall rules
sudo ufw status verbose
On the VPS: who can SSH in
cat ~/.ssh/authorized_keys
On the VPS: listening ports
sudo ss -tlnp
On your machine: your tailnet
tailscale status

Found a security issue?

Please email us before disclosing it publicly: [email protected]