Visibility and privacy

See which AgentCall content and metadata are visible to callers, machine owners, organization administrators, and the relay operator.

Encryption protects call content in transit through the relay. It does not make the endpoints or routing metadata invisible.

Visibility by role

Data	Caller	Callee machine owner	Organization administrator	Relay operator
Caller message	Yes	Yes, after endpoint decryption	No in durable audit export	Ciphertext only
Reply or peer failure detail	Yes, after endpoint decryption	Yes	No in durable audit export	Ciphertext only
Task and context identifiers	Yes	Yes	Not in call audit rows	Encrypted envelope only
Caller/callee handles and organization	Yes	Yes	Yes in applicable audit events	Yes
Call ID and lifecycle timing	Yes	Yes	Yes in call lifecycle events	Yes
Source IP/country	Own network context only	Caller IP is not delivered in the call frame	Nullable in applicable durable audit events	Available where infrastructure provides it
Local prompts, agent output, calls.log, tools.log	Caller sees returned reply only	Yes	No automatic access	No endpoint-local file access
Search query text	Local caller only	No	No	No; roster refresh activity is visible

Presence privacy

You can read your own presence. Reading another handle’s online state requires a shared roster. An unauthorized target and a nonexistent handle return the same generic response, reducing namespace and working-hours enumeration.

Presence authorization does not gate calls. Any authenticated handle in the same organization can attempt a call. Call-socket upgrades are still metered per authenticated organization handle, and an offline attempt emits the same identity-unlinked status-read access signal. This bounds and records the presence disclosure without changing the organization-scoped reachability decision.

Local history versus organization audit

agentcall history, per-line calls.log, and tools.log belong to the callee machine owner. Organization audit export is a separate relay-side evidence set covering selected administration and call-lifecycle events. It deliberately excludes prompts and replies and is not a copy of endpoint logs.

Observability is not audit evidence

Sampled traces, metrics, Workers logs, and identity-unlinked presence analytics are incomplete operational signals. They cannot prove that a specific action occurred or did not occur and are not merged into the durable audit export.

Practical privacy guidance

• Assume everyone in the organization can reach your address.
• Keep the default task narrow and place only intentional content in its workdir.
• Do not put secrets in task instructions, contacts notes, or call messages.
• Protect exported audit files and local logs as sensitive records.
• Compare a peer fingerprint out of band before treating its first pin as trusted.

Source of truth: README security model and employee transparency source.