Privacy
Your vault, and the access around it.
Pantheon stores account infrastructure on its server and keeps saved context in the GitHub repository or Google Drive folder you choose. These are the exact access and processing boundaries.
Google Drive access
Creator accounts request identity scopes plus exactly https://www.googleapis.com/auth/drive.file. That scope lets Pantheon create and access the visible Pantheon Vault folder and files it creates or you explicitly open with Pantheon. It does not grant blanket access to the rest of your Drive.
GitHub access
Developer setup temporarily requests GitHub's broad repository creation authorization because GitHub has no create-one-repository scope. Pantheon uses that token to create the private vault, immediately revokes it, and does not retain it. Ongoing access uses the GitHub App installed only on the selected vault repository; all-repository installations are refused.
Credentials held by the service
The control-plane database holds account, pairing, machine, sharing, and token records. Google access and refresh tokens are encrypted before storage. A refresh token is retained so connected agents can sync after the short-lived access token expires. GitHub App credentials are exchanged for short-lived installation tokens when needed.
Hosted processing and local caches
Hosted handoff, resume, ranked retrieval, exact search, and sharing requests temporarily materialize the files needed to answer the request. Retrieval derives scores and a bounded evidence packet from that materialized copy; conversation and artifact content is not stored as a separate database archive. Paired desktop clients keep a local working cache so agents can read and sync the vault; revoking a share removes that shared cache on the recipient's next sync, but cannot recall copies they exported elsewhere.
Sharing
Sharing grants another Pantheon account read-only access to one named space, including its sessions, memory, skills, and artifacts. It does not expose other spaces or grant write access. The recipient's provider can differ from yours.
Product feedback
Problem reports and improvement suggestions sent from Support are stored in Pantheon's control-plane database so the team can read the pattern. Optional follow-up email is used only for that report. This is not vault content and is not written to GitHub or Drive.
Disconnecting and deletion
Disconnecting erases the Pantheon account, pairing records, machines, and server-held credentials. For Google accounts, the Drive folder is retained by default and is deleted only when you explicitly check the deletion option. For GitHub accounts, the existing choice to retain or delete the repository remains. Provider access is revoked and the GitHub App is removed when applicable.
History differs by provider
A GitHub vault has commits, diffs, branches, and Git history. A Google Drive vault is a folder of ordinary files and uses Drive's file activity and version behavior; Pantheon does not represent every Drive handoff as a Git commit. Both providers keep the readable vault files in storage you control.