Most memory tools for coding agents start by asking you to send your data somewhere. You sign up, you paste an API key, and from then on the record of what your team decided lives on someone else's server. Docmancer starts from the opposite default: everything runs on your machine, and the only thing that ever leaves is ciphertext you explicitly opt into uploading.
This post explains exactly what stays local, what the optional cloud path does, and how the boundary between the two is drawn so you can reason about it rather than trust a marketing claim.
What local means here
When you install Docmancer and index your agents' memory, nothing touches the network:
pipx install docmancer
docmancer setup
docmancer ask "why did we pick Railway for production workers?" --fresh
The default engine is a static model2vec embedding model vendored inside the package, sqlite-vec for dense retrieval, and SQLite FTS5 for lexical search. There is no API key to set, no vector database daemon to run, and no model to download. setup discovers and indexes the memory your agents already wrote, while ask --fresh waits for changed sources before searching it. Both complete offline.
Recall, capture, the local workbench, MCP search, the security audit, curated Markdown, and ordinary file or Git collaboration all work without an account. That is deliberate: the features that make Docmancer useful day to day do not depend on a server being reachable, funded, or trustworthy.
What actually leaves the machine, and when
There are exactly two paths that can send anything out, and both are opt-in.
The first is consolidation drafting. If you run docmancer memory consolidate, Docmancer sends selected memory atoms to OpenRouter to produce a single review-only markdown draft. Before any text leaves, a privacy filter redacts likely secrets and credentials, and the command prints a cloud-use notice you have to confirm. Without OPENROUTER_API_KEY set, the command exits cleanly and touches nothing. This path is optional maintenance, not the core memory loop, and the everyday distill-and-review flow that combines your packs is deterministic and fully local.
The second is encrypted Personal Sync, which exists so your memory can follow you to another approved machine without giving up the local-first guarantee. Team Sync is separate and is not available yet.
How encrypted sync draws the boundary
Cloud sync is off until you connect an account:
docmancer cloud connect
Connecting shows a verification code and opens an approval page, then creates and checks a recovery kit you keep offline before starting sync automatically. The important part is what the server receives. Memory text, tags, and local file paths are encrypted on the device before anything is uploaded, using a workspace key that the service never holds. What the API stores and relays is ciphertext, along with the delivery metadata it needs to route revisions between your devices. It cannot read your memory, and neither can anyone who compromises the server.
Adding a second device follows the same rule. It shows a four-word pairing code that you confirm on an already-trusted machine. If every trusted machine is unavailable, a version 2 recovery kit can approve that exact replacement with a short-lived signature. Full device fingerprints remain available as advanced audit details, and you can revoke any registered machine.
Offline is the normal case, not an error state
Because the local store is the source of truth, losing connectivity changes nothing about how you work. Local writes create immutable revisions and queue encrypted envelopes. When the network returns, the client retries idempotently, verifies device signatures and ciphertext, writes decrypted records durably, and only then advances its transport cursor. If you never reconnect, recall, capture, the workbench, MCP, docs, audit, and curated Markdown keep working exactly as before.
Pausing is equally undramatic when you only want to stop transfer:
docmancer cloud pause
Disconnect when the machine should lose future Cloud access:
docmancer cloud disconnect
Pausing retains the device identity and keys. Disconnecting revokes the device and removes its local Cloud credentials, but does not delete anything local or cancel the workspace subscription. Remote export and remote deletion are separate, explicit account operations, so stepping away from the cloud never silently destroys the memory you have on disk.
Why this ordering matters
The reason to build memory local-first is not ideology, it is failure modes. A hosted-only memory layer fails in ways you cannot fix: the vendor goes down, changes pricing, gets breached, or shuts the product. Docmancer inverts that. Durable personal and project memory lives on your machine as inspectable Markdown and local indexes, while the network remains an optional continuity layer that sees ciphertext rather than plaintext.
Try the local path first
pipx install docmancer
docmancer setup
docmancer status
docmancer ask "what deployment decisions have we recorded?" --fresh
Run it with no account and no key, and confirm from docmancer status that everything indexed locally. When you want the same reviewed context on another machine, the Personal Sync guide walks through connecting a device and approving a second one.