Security
Why your API keys never leave your machine with Navin
March 15, 2026 · 1 min read · Navin team
BYOK, Credential Manager / Keychain / Secret Service: how Navin keeps keys local while still offering optional managed plans.
The “cloud agent” promise often means shipping keys and context to a third party. Navin flips the model: the agent comes to your machine.
BYOK first
On Free and paid plans, you can wire OpenAI, Anthropic, Gemini, OpenRouter, Ollama, LM Studio… Secrets live in OS vaults (Credential Manager, Keychain, Secret Service).
Managed plans = optional, not mandatory
Plus / Flash / Pro / Ultra / Team provision a managed OpenRouter key and budget. Your code and chats stay local. You can combine BYOK + managed catalog.
What does not leave
- Workspace file contents.
- Local chat history.
- Secrets entered as BYOK.
The navin.live account is for license, devices and usage - not to host your repo.
Product security
/fortify workflows, reviews and permissions: accuracy matters as much as velocity. Navin is built for teams that refuse “ship fast, leak keys”.
Try Navin on your machine
Local agent, cross-platform. Code, debug, scrape, leads, security and review - without leaving Navin.