Trust & security
A proxy earns trust with constraints, not promises.
Compresso sits in the path of every request your coding agent makes. This page says exactly what it will never do, and how the code enforces each boundary.
Never collects your keys
The Authorization header is copied through byte for byte, never stored, and never logged. It is read on your Mac, in memory, for one purpose: which Claude or ChatGPT plan you are on.
How it’s enforced
Structural, not procedural: the parsed request type used for routing and counting has no field that could hold a credential, and the one function that does read the token is crate-private, so the background helper physically cannot call it. Your Claude token goes to Anthropic's own account endpoint, at most once a day per sign-in session; your ChatGPT plan is read out of the token locally, with no request at all. The token is never sent to us. Neither is the plan, with one exception: opening checkout tells us which tier to bill you for, because that is the purchase.
Never sees your prompts
Optimization runs on your Mac. Prompts and code go from your agent straight to Anthropic or OpenAI.
How it’s enforced
There is no server-side path for request bodies to take. Compresso's backend handles accounts and billing; it has no endpoint that accepts prompt content.
Never rewrites your traffic
Request bodies are forwarded byte for byte.
How it’s enforced
On the direct-to-upstream path, exactly one header changes: Host, so TLS SNI lines up. Everything else, body included, passes untouched.
Never opens a port
The proxy binds to loopback only.
How it’s enforced
Requests with a non-loopback Host or any Origin header are rejected with 403, so a browser tab cannot talk to it, and neither can your network.
Never fingerprints
No hardware identifiers, no third-party analytics.
How it’s enforced
Your device ID is a random value the app generates and keeps in your Keychain. Usage reporting is aggregate counters only, and the privacy policy lists every field.
Never edits your shell
No rc files, no PATH changes, no hooks injected into your tools.
How it’s enforced
Compresso sets the base URL in Claude Code's and Codex's own config files, and nothing else. Every write is preceded by a timestamped backup; a file that fails to parse is never overwritten.
Leaves nothing behind
Uninstall restores every config it changed and removes everything it wrote.
How it’s enforced
The uninstaller shows the full list before it runs. Config restoration comes from the sidecar records written at change time, so Compresso never strips settings it didn't write.
Failure behavior
When something breaks, you don’t.
Every failure mode routes your requests straight upstream: optimizer down, still starting, subscription lapsed, app quit. A background helper keeps the port answering, and passthrough engages in under a second. A dead port would be a broken toolchain, and that is the one thing Compresso is never allowed to be.
Verify, don’t trust
The engine is open source.
Compresso runs the open-source headroom engine (Apache-2.0), fetched at first launch and integrity-checked, and a checksum mismatch is a hard failure with no continue-anyway path. What leaves your machine is documented field-by-field in the privacy policy.