Trust

Privacy & security

Second Silicon stores project and thread data in a cloud workspace and sends selected context to the model provider used for each turn.

Workspace data

Accounts, workspace membership, projects, imported design artifacts, board state, threads, notes, attachments, and usage records are stored by the managed cloud service. Protected app and API routes require an authenticated session and enforce workspace membership.

The browser stores sign-in state and local app preferences. Signing out clears the active app session; browser site data can also be removed through the browser’s privacy settings.

Provider API keys

Keys added under Settings → API Keys are scoped to the workspace and encrypted before persistence. Saved keys are masked when settings are loaded again.

Second Silicon uses a configured key only for requests to that provider. Replace a key by saving a new value in the same provider field. Removing the key prevents later turns from using it.

Provider keys are not included in thread PDF exports, chat attachment metadata, or Symbiote pairing payloads.

Model requests

A model request can include:

  • Messages and completed tool context from the current thread.
  • Active project, board, sheet, component, net, comment, and selection context assembled for the turn.
  • Firmware context and image attachments explicitly attached to the current turn.
  • Tool results produced while the turn is running.

The selected provider receives that request and returns the assistant response. Second Silicon persists the resulting thread timeline so it can be reopened and exported. Provider-side retention and training rules are controlled by the provider and the account or key used for the request.

Review the provider’s current data policy before using it with sensitive design data:

Symbiote and local resources

Symbiote runs on a paired Mac or Windows machine and advertises the local capabilities available there. A local operation is dispatched only when the app requests a matching capability. Symbiote can access files, firmware context, ECAD tooling, or instruments needed for that operation; it does not make the entire machine available to the cloud service.

Quit Symbiote or revoke the paired device from Settings to stop new local operations. Active operations and bridge sessions do not survive a restart.

Exports and sharing

Thread PDF download is an explicit action. The PDF contains project and thread metadata, notes, and completed timeline text. Treat the downloaded file as sensitive if the thread includes proprietary design details.

Security reports

Report a suspected vulnerability to security@secondsilicon.ai with reproduction steps and the affected surface. Avoid including provider keys or unrelated customer data.