# Security and privacy

Crop Steering runs on your own hardware. This page covers what stays on your network, what can be sent out, and how to report a security problem.

## What stays on your network

Crop Steering runs inside your Home Assistant. The controller talks to Home Assistant over your network with a Home Assistant token: the Supervisor gives the app its token, and for the Docker container you create a long-lived token and keep it in a file beside it. Nothing is needed from the internet to water.

## What is sent outside your network

Only the optional AI assistant. It sends the facts of a question to the AI service you configure, with your own key, and stops at the daily budget you set. The MCP connector runs on your own computer and has no network listener.

[AI and MCP setup](https://cropsteering.growlabs.nz/docs/ai-setup)

## Who can change settings

Saving a configuration needs a Home Assistant administrator, and the change history records who made each change.

[History and changes](https://cropsteering.growlabs.nz/docs/history-and-changes)

## This website's privacy

No cookies, no analytics, no tracking, and nothing loaded from other sites. Theme and notice choices are kept in your browser only.

## Report a vulnerability

Please do not post exploit details in a public issue. Open an issue that says you have found a security problem and asks for a private way to send it, and the maintainer will reply with one.

Note

Machine-readable contact details are in [security.txt](https://cropsteering.growlabs.nz/.well-known/security.txt).

[Open an issue](https://github.com/JakeTheRabbit/HA-Irrigation-Strategy/issues/new) [About the project](https://cropsteering.growlabs.nz/about) [Does it need the internet?](https://cropsteering.growlabs.nz/faq#internet)

Source: https://cropsteering.growlabs.nz/security