Safe projections

Soil Cloud stores meaning, never secrets or raw prompts. Carry-meaning-not-verbatim is part of extraction, not a filter bolted on afterward.

Soil Cloud stores safe projections only. A safe projection carries the meaning a fresh model needs, never the sensitive value. This isn't a filter that runs at the end · it's baked into the extraction recipe itself, because two failure modes are equally fatal and both have to be designed out up front.

Nothing is deleted

A save is read-only toward your AI client. It never edits, moves, or deletes the conversation it captures · your original thread stays exactly where it is, with all its history, detours, and dead ends intact. The handover is a copy that can travel to another model, client, or provider. If you like to archive full threads, keep archiving them · saving and archiving are not in competition.

Carry the meaning, never the secret

The recipe instructs the extracting model to describe that something exists and where it's configured · never to reproduce it:

✓ "An Anthropic API key is configured in the project's environment as ANTHROPIC_API_KEY."
✗ The actual key value.

Same rule for credentials, tokens, auth headers, private absolute paths, raw source contents, and other unsafe atoms · branch names, PR IDs, commit hashes, raw logs, and auth/runtime/deploy identifiers. The rule strips the unsafe atom, not the surrounding meaning: redact the value, keep the truth.

What Soil Cloud never stores

A fail-closed safety guard re-scans every filled schema before save. Forbidden from the cloud, always:

Raw prompts, raw model responses, raw provider payloads, or raw logs.
Secrets, API keys, auth headers, or tokens.
Full private absolute paths.
Source-file contents and exact file inventories.
Branch names, PR IDs, commit hashes, and auth/runtime/deploy identifiers.

The guard is a fail-closed scan over the filled schema: it rejects a forbidden field name, a raw-data sentinel, or a secret/private-path pattern anywhere in the payload. If it fires, the save fails closed · the handover is not saved, and you get a safe, value-free note of what to fix.

Why both refusals are designed out

Two refusals, one rule

If an extraction tries to carry a secret, two things can break: the extracting model may refuse to write it, and the loading model may refuse to read it. Carry-meaning-not-verbatim avoids both · and keeps the cloud copy safe. One rule solves leakage and block-avoidance.

The honest tension

Completeness ("enough to continue without drift") and safety ("never enough to leak or get blocked") genuinely pull against each other. Soil holds both, and when they collide, safety wins and the gap is reported as an unsafe omission · so the reader still knows the thing exists, just not its value. The gap is never silently dropped.

Local-rich, cloud-safe

Soil Desktop keeps your handovers on your own machine · full fidelity, local. If you turn on cloud backup, only the same safe projection crosses the boundary · the cloud boundary is unchanged, it receives safe projections only. That's the local-rich, cloud-safe principle: highest fidelity on your own device, portable and safe in the cloud.