Ocur
ENDE
Start free

Trust

Where your data goes

Ocur does real work with your email, your files and your conversations, and that work runs on services we don't operate ourselves. This page is the plain map: which service receives what, when it does, what stays put, and what you can switch off. It is written from the code, and it changes when the code does.

Last updated 3 September 2026 Applies to app.ocur.ai · the Ocur mobile and desktop apps Companion to the privacy policy

The honest headline

  • Ocur is a cloud product. Reasoning happens on hosted AI models, code and document work happens in a hosted sandbox. There is no local-inference mode.
  • Nothing you connect is read until you connect it, and every connection can be taken away in one click. Ocur only reaches what you asked it to reach.
  • We never sell your data and never train models on it — and every provider below is bound the same way for the content we send it.
  • For data that must not leave your own infrastructure, the answer today is honest: don't put it into Ocur. Self-hosting keeps storage in-house, not processing.
Contents

01Always on — every chat turn

Every message you send Ocur, and every message Ocur handles for you on a connected channel, is answered by a hosted AI model. These services take part in every turn:

Service What it receives Good to know
Your chat model — Moonshot (Kimi) unless you pick another; Anthropic, OpenAI and Google Gemini are selectable in the app The full conversation, Ocur's instructions, tool results and the text of attachments If a provider errors, the turn is retried on the next provider in a fixed chain, which for the default starts at Anthropic. Moonshot is based in the PRC; a deployment that must keep traffic off it changes the default.
OpenAI Every conversation Ocur holds on a connected channel — WhatsApp, Telegram, Discord, Slack, Teams, email and social platforms — regardless of your model pick; and the unattended background work: dashboard and widget refreshes, digests, heartbeats, collection chases, long-conversation summaries, skill distillation and the extractors for commitments, feedback and competitors Pinned per deployment. Anthropic is the first fallback so one vendor's outage doesn't take your channels down.
Supermemory Only what Ocur explicitly saves with its memory tool — short, distilled facts — plus one rollup summary per roughly 15,000 tokens of a long chat. Team- and organization-scoped saves wait for a human approve/deny first. There is no background per-turn upload. Leaving the memory service unconfigured switches memory off entirely.
Clerk Identity: your email address and session tokens Login does not work without it.
Sentry Error reports, without request bodies by default Off when unconfigured. A provider's error body can echo request fragments into a log line.

02When you use a feature

These services only see your content when the feature that needs them runs. Leave a feature unused and its service receives nothing.

Service Triggered by What it receives
E2B (cloud sandboxes) Any code, file or document work — running code, shell commands, attachments Attachment bytes, generated files, your workspace's file tree, and connector secrets as environment variables for the duration of the job
AgentMail The Ocur inbox Hosts the mailbox itself — every inbound and outbound mail body
Microsoft Graph / Google APIs A connected Outlook, Gmail, Calendar or Drive Mail, events and files flow both ways under the consent you gave when connecting
OpenAI Vector Stores Knowledge-base uploads (the default knowledge backend) The complete document, stored at OpenAI. A deployment can keep new knowledge in its own database instead; then only chunk text transits OpenAI's embeddings API and nothing is stored there.
OpenAI Realtime Voice mode Raw microphone audio, streamed from your browser straight to OpenAI
Browserbase Ocur browsing the web for you Page contents, screenshots and URLs
Exa Web search The search queries Ocur composes
ElevenLabs Spoken replies The text of the reply
Zernio, Merge.dev, Slack, Telegram, GitHub, Notion, Stripe, Higgsfield The respective connector The message or content for that channel

03What stays put

  • Our database (self-hostable, in the EU): conversations, messages, memories, contacts, workflows, the audit log, approvals — and Ocur's learning record: a ledger of the consequential actions it took, the edits people made on approval cards, and what came of them. The ledger stores sanitized display-shape parameters, never credentials, and is deleted with the organization.
  • Our file storage: files you upload and files Ocur generates.
  • AgentMail: the mailbox archive. OpenAI: knowledge documents, in the default configuration.
  • Your computer: only the local companion's own small state file.
  • Connector credentials are encrypted at rest.

04What you can switch off

  • Draft-only mode and queued approvals gate actions, not data flows: with them on, Ocur still reads what it needs to draft, but sends and posts nothing without a sign-off.
  • Guardrails. New accounts start on the operator tier: outward actions — sends, posts, controlling your machine — show an approval card; sandbox work and drafts run freely. You widen or narrow this per tool in Settings › Guardrails.
  • Disconnect. Taking a connected account away stops every flow that depended on it, immediately.
  • Per deployment, leaving a service unconfigured switches that service and its feature off, and knowledge can be kept in the deployment's own database.
  • Self-hosting keeps the app and the database in-house; the AI providers, the sandbox, identity and memory remain external services.

05Two everyday jobs, traced

Email and calendar. An inbound mail body arrives at AgentMail → our backend → the chat model. Ocur's memory service sees it only if Ocur explicitly saves a fact from it, and a team-scoped save waits for a human first. Calendar events travel Google or Microsoft → our backend → the chat model. Drafts are written back into the mailbox; with draft-only mode on — the default for new inboxes — nothing is sent by Ocur.

Generating a document. The template and case data you attach go to our backend (at rest in our file storage) → the sandbox for processing → the chat model for the extracted text → the finished document back through our backend to your browser. If the knowledge base is used, those documents additionally live at OpenAI in the default configuration.

06What we will not promise

No zero-egress switch

There is no setting that keeps your content off every external service, and we won't say there is. If a workflow must not leave your own infrastructure, it does not belong in Ocur today. Everything else on this page is a lever you can actually pull.

07Questions

If a flow here is unclear, or your compliance review needs it in another form, write to us. We answer with specifics, not a brochure.

See also the privacy policy and the terms of service.

← Back to ocur.ai