Security

Everything runs locally

Orcha is a native macOS application that runs entirely on your machine. Your code, project files, terminal output, and session data never leave your Mac. There is no cloud component, no server-side processing, no remote storage, no account, and no license server.

Network activity

The complete list of network traffic on a machine running Orcha:

• Claude Code's own traffic — the claudeCLI communicates with Anthropic exactly as it does in any terminal. Orcha drives the CLI; it doesn't intercept, proxy, or add to that traffic.
• Update check (opt-in)— if enabled, the app checks our update server for new versions. This sends your current app version and nothing else.

There is no telemetry, no analytics, no crash reporting, and no license validation. Ever.

Local data storage

Orcha stores its own state — preferences, workspaces, and session metadata — in a local SQLite database and config files under your home directory.

It reads (but never modifies) Claude Code's own files:

• ~/.claude/ — session history and project data (read-only)

Voice dictation

Voice dictation uses macOS native on-device speech recognition. Audio is processed locally and never sent to any external service.

Code signing

Orcha is code-signed with an Apple Developer certificate and notarized by Apple. This ensures the app hasn't been tampered with and passes macOS Gatekeeper checks.

Responsible disclosure

If you discover a security vulnerability, please email security@orcha.build. We take all reports seriously and will respond within 48 hours.