> ## Documentation Index > Fetch the complete documentation index at: https://docs.perceo.ai/llms.txt > Use this file to discover all available pages before exploring further. # Local-first > What self-hosted means in practice across the three products. Perceo has one hard constraint: the machine that holds your code, your VMs, and your notes is a machine you control. Everything else follows from that. ## What runs where | Component | Where it runs | What leaves the machine | | ---------- | -------------------------------- | ---------------------------------------------------- | | Archductor | Your desktop | Only what `git` and `gh` already send to your remote | | Archfleet | Your libvirt host | Model API calls for the computer-use agent | | Archivum | Your server or laptop, in Docker | Model API calls for ingest, embeddings, and search | There is no Perceo account, no Perceo-hosted control plane, and no telemetry endpoint. If you point the model calls at a local model, nothing leaves at all. ## Credentials stay where you put them Archductor does not store or proxy credentials. It drives the CLIs you have already authenticated: * `gh auth login` for pull requests, checks, comments, and merges * your existing `codex` and `claude` local authentication for agent sessions * `openssh` for SSH repository access Archivum reads its keys from a local `.env` written during setup. Archfleet uses your hypervisor's own access model. Local-first is not the same as offline. Agent sessions and Archivum ingest call a model provider unless you configure a local one. ## Why it is built this way Coding agents and computer-use agents want broad access — your whole repo, a real desktop, your notes. That is a reasonable thing to grant a tool running on your own hardware and an unreasonable thing to grant a SaaS product. Keeping the control plane local is what makes the access level acceptable. It also means the failure modes are yours to fix. Nothing is gated behind a status page you cannot see.