Msty

US CLOUD Act exposureproprietary

STAV REVIEW · LAST REVIEWED 06/21/2026

“Privacy-by-architecture desktop client: CloudStack never touches your prompts, but it's a closed-source US binary with no audit trail for enterprise.”

Good for

Teams wanting local LLM inference on macOS, Windows, or Linux without any vendor data custody
Air-gapped or low-connectivity environments — Ollama, LLaMA.cpp, and MLX work fully offline out of the box
Individuals or small teams who connect their own cloud provider keys and want direct client-to-provider Inference with no intermediary
Buyers who need a DPA on record but operate outside regulated sectors where GDPR Article 28 adequacy is required

Watch out for

Closed-source binary with no published SBOM, no documented binary signing, no bug bounty, and no security.txt — independent code review is not possible
CloudStack, LLC is a Delaware entity under full CLOUD Act jurisdiction; the near-zero data footprint limits exposure today, but any architecture change would activate that risk immediately
SSO/SAML and audit logging are publicly unconfirmed for Teams and Enterprise Desktop tiers — regulated-sector buyers should get written confirmation before approving deployment
The Homebrew cask is deprecated and pinned at v1.9.2 (live app is v2.8.0) — install via msty.ai only; and do not deploy Msty Claw (autonomous agent, beta) without a separate risk assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What Msty needs from a model.

Required

Streaming

Recommended

Long context (≥128k)
Vision input

Data flow & telemetry

How Msty moves data between the client, the inference endpoint and any vendor-owned services.

Data flow

Direction: local_only
Stores prompts: No

Telemetry

Collects telemetry: false
Privacy policy: https://msty.ai/privacy/

Vendor & licensing

Developer: CloudStack, LLC
Vendor country: US
Vendor type: startup
Funding status: unknown
Runtime type: desktop_native
Open source: No
Licence: proprietary
Licence risk: commercial_only
CLOUD Act exposure: Yes

Security & maintenance health

Security profile

Bug Bounty: false
Auto Update: false
Cve Count 90d: 0
Sbom Published: false
Cve Count Total: 0
Signed Binaries: false
Has Security Txt: false
Dependabot Alerts: false

Maintenance health

Archived: false
Last Commit: 2026-06-11
Last Commit Date: 2026-06-14
Release Cadence Days: 11

Popularity

Heimdall Team Count: 0