Desktop apps and CLI
Everything that touches messages runs on your own machines, from generating and checking them to de-identifying, migrating, and monitoring them. We never receive that message content.
Your message content stays with you.
Pidgeon runs on your machines, and nothing leaves unless you set it up to. Here is exactly what does and doesn’t leave, including the caveats.
Account and licensing
Signing in and checking which products you can use go through our account service. Those requests identify you and your plan, and they never carry message content.
AI goes where you send it
A model on your device keeps everything local. If you use your own cloud provider or API key, data goes to that provider, under your agreement with them.
What leaves your environment
- Healthcare message content
- Stays on your machine. It is never sent to us.
- License checks
- Your account, your organization, and which products you can use.
- Software updates
- Nothing automatic. You download new versions from pidgeon.health/download.
- Account site errors
- Error reports from the account website, with personal details removed. Never message content.
- External AI
- Only if you choose a provider and set it up yourself.
Responsible disclosure
If you find a vulnerability in the engine, desktop apps, account service, or website, email security@pidgeon.health. Include the affected surface, reproduction steps, and likely impact.
Where the beta stands today
The Windows installers are code-signed. The Mac builds are not yet signed or notarized by Apple. We have not completed a SOC 2 audit, and this page describes how Pidgeon is built today, not a certification.