The same AI tool has two front doors. Only one keeps your files at home.

Many of the AI tools your team will want this year come two ways. One is a web page: paste your text, upload your folder, get the result. The other is a command you install and run on your own computer. Same tool, same output, often the same author. It is tempting to read them as two levels of convenience, the easy one and the technical one. They are two different answers to a simpler question: where do your files go while the tool works on them? With the local version, nowhere. With the hosted one, to somebody else's server, in a place you did not choose and may not be told.

One tool, two front doors.

Repomix packs a software repository (a project's code and the files around it) into one file an AI model can read in one go. It is MIT-licensed, free, and has more than 28,900 stars on GitHub.[1] A developer uses it to hand a coding assistant a whole project, or to understand an unfamiliar one before adopting it.

Look at the top of its README and the first call to action is the hosted version: "Use Repomix online!"[1] Enter a repository name, pick a format, press Pack. Further down, the same capability is a command, npx repomix, that runs on your machine, also free. There is a browser extension that adds a Repomix button to GitHub pages, and a local server mode that lets a coding agent call Repomix directly. Count the website twice (once with a repository address, once with an upload of your own files) and add the command line's option to fetch a public repository itself, and that is six ways a person or an agent hands this one tool its files.

That shape is not peculiar to Repomix. PDF converters, transcription tools, document summarisers and code helpers often ship the same pair: a page for people who want a result now, and a local install for people who care where the data goes. Repomix is a useful specimen because both doors are fully documented, including the hosted one's server code.

Where each surface runs.

Here are the six surfaces side by side: where each one runs, what leaves your machine when you use it, and the verdict we would apply to client data. Three keep the files on your computer. One is a doorway to the hosted site. Two run on the hosted site itself.

The second row is the one people misread. Running the packer locally keeps the packing local. It says nothing about the next step, and the next step with an AI tool is almost always sending the result to a model, which for most teams is hosted too. A local tool narrows where your data goes. It does not end the question: where the model runs is the same Law 25 question, and our note on the open tier at a third of the cost works it for hosted models.

What the hosted door actually keeps.

Credit where due: Repomix documents what its hosted side keeps. Its privacy policy says that when you upload a ZIP file or folder, "your files are temporarily stored on our servers for processing" and are "automatically deleted immediately after processing is complete".[2] The server code is public, and on that point it agrees with the policy: uploaded files are never cached, and the output file is removed once the result is sent back.[3] The site also runs Google Analytics on page views and Cloudflare Turnstile, a bot check that "may collect browser and network signals".[2]

So, on retention, the answer is a good one. What the policy does not say is where the processing happens. The server's build configuration in the repository deploys it to Google Cloud Run, in the us-central1 region, which is in the United States.[3] That is the configuration as published, not a promise. The policy does not commit to any region, and we did not confirm where the live service runs.

That gap is not specific to this tool. A good retention answer and a location answer are two different things. "Deleted immediately" means the copy does not stay. If the published configuration is what runs, the files still went to a server in another country to be processed.

Three questions before you paste.

You do not need to read source code to make this call. Three questions, asked in order, cover most of it, for Repomix or any tool that offers a paste box.

Question one does most of the work. If a local version exists and does the job, the other two questions disappear. With Repomix the local command is the more capable surface anyway: it can read private repositories through the git access your developers already have on their machines, which the hosted site cannot.[1]

Question two is answered in the privacy policy, not the marketing. Home pages talk about speed. The policy is where a provider commits to what it keeps. If there is no policy, or it does not cover uploaded content, treat that as the answer.

Question three is the one Quebec businesses skip. In general terms (this is the posture we work from, not legal advice): Quebec's private-sector privacy law, as amended by Law 25, requires a privacy impact assessment before personal information is communicated outside Quebec, including to a provider outside Quebec that only processes it, and a written agreement that reflects that assessment.[6] Short retention does not change the fact that the information crossed the border. Our note on running AI on your own hardware goes further into that line, which is the Quebec border, not the Canadian one.

And code is not exempt because it is code. Repositories carry personal information more often than their owners think: test data copied from production, a customer export someone committed by mistake, log files, a configuration file with a client's contact details. Confidential client material can also be bound by the confidentiality terms you signed with that client, whatever the privacy law says.

One file, one place to leak.

One more risk applies to every tool that gathers everything into one file, whichever door you use. A packed repository is convenient because it is complete. That is also what makes it risky. Every file that was scattered across a project, including the one with a password in it, is now in a single file that is easy to paste, email, drop in a shared folder or attach to a chat.

Repomix ships a guard for this: it runs Secretlint, a scanner that detects "files matching known credential formats" and leaves them out of the output.[1] That is a real help. It is also, in the project's own words, "an additional heuristic safeguard", and its documentation says plainly that "the access boundary is the workspace root, not the scan": what limits exposure is which folder the tool is allowed to read, not the scanner.[4] Put simply, the scanner catches the formats it knows. A password in a format it does not recognise goes through. And it looks for credentials, not personal information: the customer rows in a test file are not what it scans for.

So treat the packed file the way you would treat the most sensitive thing it might contain.

1. Choose what goes in, instead of packing everything.

   Repomix takes include and ignore patterns and an ignore file. Pack the folders the task needs, not the whole project with its data and logs.

   → the file holds what the job needs, nothing more
2. Read the output before it moves.

   Search it for the obvious: passwords, keys, email addresses, a client's name. The scanner is a first filter, not the last look.

   → a person has seen it before a model does
3. Do not let it linger.

   Keep it out of synced and shared folders, and delete it when the task is done. A forgotten file in a cloud-synced folder is one easy way for this kind of exposure to start.

   → the copy lives as long as the task

Why Repomix makes a good example.

None of this is a criticism of Repomix. It is the reverse. The project documents its own limits better than most tools we look at, which is exactly why it works as a specimen. It publishes a privacy policy that addresses the website, the command line and the browser extension separately. It treats a downloaded repository's configuration file as code that could run, "comparable to running its Makefile", that is, running a project's build commands sight unseen, and refuses to load it by default.[4] It describes its own sandbox mode as "an application-level confinement of the tool surface, not an OS-level sandbox".[1] And it calls its secret scanner a heuristic instead of selling it as protection.

A tool that tells you where its boundaries are lets you make the decision in fig 1 from its own documentation. Many hosted AI tools give you a paste box and a promise. When one gives you a local version, a privacy policy that separates the website from the local tools, and its own server code, use the local version for anything private and keep the hosted one for public material. Our six-gate review shows the same habit in a worked example, an AI add-on that passed a safety check and was still declined: the data path of the use case is one of the gates.

What this does not claim.

We did not test the hosted service. The retention, cache and region statements come from Repomix's privacy policy and the server code and build configuration it publishes. The region is the published configuration, not a confirmed deployment, and a policy can change after we read it.

Not a security review of Repomix. We read its documentation and parts of its code to see where each surface runs. We did not audit the tool, and nothing here says it is unsafe.

Six surfaces, not every one. Repomix also ships a GitHub Action, a programming library and plugins for a coding assistant. Fig 1 leaves them out: the plugins run Repomix's local tools inside the coding assistant, the library runs wherever your own code runs, and the Action runs wherever your build pipeline does, which is its own data-path question.

The verdicts are a posture. "Public repos only" and "not for client data" are the rules we apply. A business with different data, or a signed assessment for a given provider, could reasonably draw the line elsewhere.

If your team is weighing an AI tool that offers both a hosted and a local version, describe the tool and the kind of material you would put into it (the kind, not the material itself) through the contact form. We will write back, free, with which surface we would use and what we would keep out of it. Choosing and setting up AI tools around where your data lives is part of our assistants and agents services.