Five safeguards. No database proxy.

Credentials are stored keychain-first — your OS keychain with an encrypted vault fallback — never in Zolt plaintext config.

Remote database sessions require TLS or an SSH tunnel; local files and local sockets stay local.

Sensitive values are redacted before diagnostic logs are written.

Desktop telemetry is off. License checks carry status only, not database content.

AI is BYOK on every tier. Zolt does not proxy or store your prompts, responses, or provider keys.