Skip to main content
With Orchestra Local, each person’s sessions and memories live on their own laptop. A team admin can move a repo, or the whole team, to Orchestra’s hosted store with one command, and move it back the same way. Nothing changes form on the way: the hosted store holds the same events the laptops held, with the same ids, so every memory still points at the moment it came from.

Storage levels

Levels 0 to 2 are set in your team’s policy. Level 4 puts your data where our servers can read it, so it is never a policy setting: it needs a team admin’s consent after a preview, and that consent is recorded. Level 3 is not offered yet. It would keep the hosted product to memory only, and that limit is not built: a repo at level 3 would show everything it shows at level 4. Until it is, orchestra promote moves a repo to level 4 and refuses level 3.

Move a repo to a hosted level

A team admin runs this in the repo:
  1. Sign in. This is the first time Orchestra Local needs your Orchestra account. If you are not signed in, a browser opens.
  2. Preview. You see exactly what your laptop would send: the number of events by kind, the date range, how many sessions and how many of them are private, a few session titles, and what stays on your laptop. Nothing has been sent yet.
  3. Consent. You read one sentence that names the repo and the level, and type yes. Anything else stops, with nothing sent.
  4. Upload. Your consent is recorded in your team’s log (who, when, which repo, which level, and the preview you saw). Then your laptop uploads its own log for the repo, and from then on new sessions in that repo on your laptop are stored hosted.
Options: --repo github.com/acme/app for a repo other than this folder’s, --team for every repo, and --yes to agree without the prompt. orchestra promote --status shows what is promoted and how far your laptop’s upload is. The terminal client’s Hosted view (ctrl+g) shows the same preview for the repo you are in. Only a team admin can promote. Anyone else is refused, and nothing is recorded or sent.

Each teammate’s laptop sends only its own

Your teammates do not run anything. Their laptops learn of the move with the rest of your team’s policy, the next time they check in: every few minutes on a laptop registered to your team, or whenever they run orchestra login or orchestra promote --status. Each one then uploads its own log for the repo and nothing else. No laptop ever uploads anyone else’s sessions, and our servers refuse an upload that tries. What goes:
  • Every event of the sessions you started in that repo, with their original ids and times.
  • The memories you remembered in those sessions, and their later changes (a forgotten memory stays forgotten).
What stays on the laptop:
  • Sessions in other repos.
  • Memories you remembered outside any session: they belong to no repo, so they move only when the whole team is promoted.
  • Anything a teammate wrote on your laptop (each laptop sends only its own person’s work).
  • Raw agent transcripts, model keys and the device’s credentials.
  • The search index and summaries: the hosted store builds its own from the events.

Private stays private

A session that was private on the laptop is private in the hosted store: its owner sees it, and nobody else finds it in lists, search, recall or memory. The privacy setting travels with the session, ahead of its first message, so there is no moment when it is visible to the team.

Safe to repeat

Uploading is idempotent by event id. If an upload is interrupted (the laptop sleeps, the network drops), it resumes where it stopped. Running it again changes nothing.

After the move

The hosted store is the source for that repo. Your laptop’s CLI, hooks, the MCP server for your agents, and capture all reach Orchestra’s API for that repo, and keep using the laptop for every other repo. There is no ongoing sync between the two: the upload happens once, and the laptop’s old copy is kept, unused, until you delete it. Recall answers from the uploaded events right away, with the same citations your laptop gave. Summaries and derived memories for sessions from before the move are written when your workspace asks for its history, at the price shown in Settings, as for any earlier session. Memories you published to your team through git stay in git. Promotion moves each laptop’s log, not your repo’s Orchestra refs. Integrations move with the repo: what Linear and GitHub synced on each laptop is uploaded with the log, and the workspace connects each one once. See Integrations on Local and in the cloud for what each integration does at each step.

Move back down

A team admin runs this in the repo:
  1. Export. Everything your team’s hosted store holds for the repo is written to the file: every session and memory event in it, from every teammate, in the same event format the laptops use. The file is checked against the store before anything is deleted.
  2. Confirm. You type the repo’s name (or team).
  3. Delete. The repo’s data is deleted from Orchestra’s hosted store, and a deletion record is added to your team’s log.
The export holds sessions and memory. It does not hold the work a cloud session saved outside its machine (unpushed commits and uncommitted files): that copy is deleted with the session. For a cloud session whose work is not on GitHub, run orchestra restore <session-id> before you move the repo down. Laptops switch the repo back to Orchestra Local at their next check-in. To bring the hosted work back onto a laptop:
The import keeps every id, so importing twice changes nothing and every memory cites the same events as before. Your own sessions are yours again on that laptop; your teammates’ sessions come back with their own privacy, so a private one stays theirs.

What is deleted, and what is not

Deleted from Orchestra’s hosted store:
  • Every event of the repo’s sessions, and the memory events tied to them.
  • Everything derived from them: the search index, session summaries, transcripts, derived memories that cite any of those events, the links between sessions, commits and people, privacy settings, and screenshots no other session uses.
Not deleted:
  • The record of the move. Your team’s log keeps the promotion (who, when, which repo, which level) and the deletion record (who, when, how many events and sessions, and a fingerprint of the exported event ids). Neither contains your content.
  • Account and team data. Your team’s members, devices, plan and policy are kept at every level, Local included.
  • Memories tied to no repo, when you move one repo down. Moving the whole team down includes them.
  • Backups, until they expire. Our backups of your team’s log are kept for 35 days and database snapshots for 7 days, then they expire and are not restored from. Service logs are kept for 30 days.
Deleting is the one time we remove events from a team’s log, which is otherwise append-only. It happens only on an admin’s instruction, after the export, and it is recorded.

Moving levels and privacy modes

Storage levels say where your team’s log lives. Workspace privacy modes are a separate, planned setting (not built yet) for what Orchestra’s hosted store keeps once content is there: for example, conversations without code, or end-to-end encrypted data we cannot read. Until privacy modes exist, promoting to level 4 means Orchestra’s servers can read what your laptops upload, the same as any hosted workspace today. If you need Orchestra never to read your sessions, stay on Orchestra Local (levels 0 to 2). In every level and mode, who may see a session is decided the same way: privacy settings do not change when data moves.