Security and privacy

Where your token lives, what BuildCaptain sends and to whom, and how AI agent access is locked down.

Written by Loris Siegenthaler · Maker of BuildCaptain

2 min read

Updated August 20, 2026

Your credentials

Your Jenkins API token is stored in the macOS Keychain, never in a file or preference.
It is sent only to the Jenkins server you configured, over HTTPS — plain HTTP is refused for public hostnames and allowed only for private network addresses (e.g. http://192.168.1.20:8080/), where traffic stays on your LAN or VPN — that exception requires BuildCaptain 26.8.3 or later. Responses that try to redirect requests to another host are blocked.

BuildCaptain has no accounts, no cloud backend, no analytics, and no telemetry. The only server it talks to is your Jenkins.
The app runs in the macOS App Sandbox.
The debug log (Logs page) lives in memory only, records request metadata (method, path, status, timing), and never contains tokens, response bodies, or build output. It disappears when the app quits.
Purchases are handled entirely by the Mac App Store — we never see payment details.

Agent access is off until you enable it, and even then:

Agents connect through a local socket on your Mac, restricted to your own user account — nothing is exposed to the network.
Agents never receive your Jenkins credentials; every request runs through the app, which enforces your run configurations: allowed pipeline, repository match, parameter allow-lists, and optional human approval.
The companion CLI is open source (MIT) — you can audit exactly what runs on your machine.

The marketing site you are reading is separate from the app and is covered by our privacy policy.