What does CairnIQ mean, and is it related to Cairn?
CairnIQ is one word — cairn, the stacked stone markers that show a route, plus IQ. A cairn marks a path without telling you to take it, which is how this software treats research: it lays out the evidence and leaves the decision with you.
CairnIQ is an independent, self-hosted project. It is not affiliated with Cairn.info, Cairn Energy, Cairn RPG, Cairnify, Cairn Insights, or any other product using the Cairn name.
What are the system requirements to deploy CairnIQ?
CairnIQ runs on Windows, macOS, and Linux environments. You need:
• Python 3.12 or 3.13 (3.11 and below are no longer supported; 3.14 is not yet supported).
• An active internet connection for API tickers synchronization and yfinance scans.
• Approximately 100MB of local storage space for logs, local configurations, and cache files.
How do I verify dependencies and start the local server?
Clone the repository, navigate to the folder, and run:
• macOS & Linux:
git clone https://github.com/aymanyaq/cairniq.git
cd cairniq
./install.sh
./CairnIQ.command
• Windows (Open PowerShell as Administrator in the project directory):
git clone https://github.com/aymanyaq/cairniq.git
cd cairniq
Set-ExecutionPolicy Bypass -Scope Process
.\install.ps1
.\CairnIQ.bat
This starts the local FastAPI server at `http://127.0.0.1:8000` and opens the terminal interface in your default browser.
Are my API keys saved in raw plaintext files?
No. When you paste a key into Settings it goes straight into your OS keychain — Keychain on macOS, Credential Manager / DPAPI on Windows, Secret Service or KWallet on Linux. It is never written to disk in plaintext along the way. Reads then load it into process memory from the keychain.
There is also a migration path on startup, for keys that are already sitting in a .env file — from an older install, or a hand-edited config. Those are moved into the keychain and the value in .env is blanked. That path exists to clean up plaintext keys, not to create them.
One exception worth knowing: if the keyring package is unavailable or the platform has no usable backend — common on headless Linux, in Docker, or in CI — CairnIQ falls back to .env and plain environment variables so the app still runs. The console flags this at startup. In that setup your key is not encrypted at rest, so protect it with file permissions or an external secrets manager.
Does CairnIQ upload portfolio data to a remote cloud?
Not for storage. Your portfolios, ticker history, journal notes, and chat transcripts are stored only inside the local user_data/ directory on your hard drive — there is no CairnIQ cloud account, no sync service, and the application ships no trackers, analytics, or telemetry.
Transmission is the separate question. To answer anything about your holdings, the relevant positions are included in the prompt sent to whichever LLM provider you configure — that is unavoidable for a system that reasons about your portfolio. Those prompts are not used to train foundation models, but they may be retained briefly for abuse monitoring. The per-provider windows are in the LLM provider question below.
How are LLM provider policies handled?
CairnIQ routes requests to enterprise developer endpoints (AWS Bedrock, the Anthropic API, OpenAI, Azure OpenAI / AI Foundry, or Google Gemini via Vertex AI). Switch providers instantly via the local terminal interface.
Training: across all of these, prompts sent through the developer API are not used to train foundation models by default. This is the consistent commitment.
Retention is a separate question, and it is not zero. Most providers keep prompts for a limited window for abuse monitoring:
• AWS Bedrock — the strongest default: zero data retention and zero operator access for most models. Some third-party models on Bedrock retain classifier-flagged traffic up to 30 days.
• OpenAI — abuse-monitoring logs up to 30 days, unless approved for Zero Data Retention.
• Azure OpenAI — stores prompts and completions for possible human review, unless approved for modified abuse monitoring.
• Google Vertex AI — may log flagged prompts up to 90 days; opt-out available on request.
Pick your provider with this in mind. These policies change — always check the provider's current terms rather than relying on this page.
What brokerages can I connect?
CairnIQ natively supports direct API synchronization with popular brokers (e.g. Questrade, Alpaca). Additionally, you can upload standard CSV spreadsheets exports from any broker (Fidelity, Interactive Brokers, Vanguard, Schwab) directly. Overlapping positions are automatically merged and deduplicated.
How do I know it isn't making the numbers up?
Every advice-generating turn passes a review gate before you see it. Deterministic code runs first — grounding (does every number and holding claim trace to data the model actually had?) and a compliance pre-check that extracts proposed trades and checks them numerically against your stated caps. A challenge model then audits what code can't: unsourced figures, claims about positions you don't own, invented history, and invented rules. Every verdict is written to a local audit trail, and each turn carries a provenance record of how much of its evidence was live, stale, or unavailable — thin evidence caps the answer's confidence rather than shipping like a fully-sourced one.
Does it do anything when I'm not asking?
Only if you switch it on — background work is opt-in per profile and off by default. With it enabled, zero-LLM monitors watch for market state changes, re-check the trigger levels the advisor committed to, sweep earnings and ex-dividend dates on names you hold (T-3 and T-1 only), and assemble a one-page review on Sunday evening. Everything lands in one deduplicated inbox. Two rules keep it quiet: it alerts on changes rather than standing conditions, and it refuses to fire on data it can't prove is recent.
Does it invent risk rules for me?
No — and this is deliberate. There are no house defaults: no built-in "2% risk rule", no default concentration cap, no suggested drawdown playbook or rebalance band. Limits come only from what you state, an unstated limit enforces nothing, and a rule you never wrote is never quoted back to you as yours. A readiness panel shows which of your inputs are still blank and exactly which feature stays switched off until you fill them — without ever suggesting a value, because a suggested number gets read back later as your own decision.
Can I use CairnIQ for commercial advisory purposes?
No. CairnIQ is licensed strictly for personal, non-commercial use. Commercial use within hedge funds, registered investment advisors (RIAs), family offices, or paid newsletters is strictly prohibited.