JARVOS is a local-first application. By default your most sensitive data — email content, credentials, contacts — never leaves your machine; a few opt-in features send data out only when you turn them on. This page describes the security measures applied to data that does cross a boundary.
IMAP and SMTP passwords are encrypted with AES-256-GCM before being written to your local database. The encryption key is stored in your OS keychain (Windows Credential Manager / macOS Keychain / libsecret on Linux) — never in config files or environment variables.
Your email, WhatsApp messages, and contacts are stored in a SQLite database on your machine. By default nothing is transmitted to JARVOS servers, and JARVOS has no copy of your data. Two opt-in features can send data out when you enable them: remote e-signature (below), where an end-to-end-encrypted copy we cannot read transits our relay for an external signer; and the Claude Cowork connector, which sends whatever Claude requests — your recent mail, contacts, or pipeline — to Anthropic's cloud.
Sessions are authenticated with JWTs signed with a server-side secret, and every API endpoint verifies the signature on each request. In the desktop app, credentials are held in your OS keychain. The web account portal stores its session token in your browser's local storage so you stay signed in between visits.
JARVOS performs a daily VACUUM INTO backup of your local database and records a SHA-256 hash of each backup file. A weekly integrity check re-hashes the most recent backup and compares it against the stored hash to detect any corruption.
All incoming webhooks (Stripe, Meta Cloud API, QuickBooks, Xero) are verified using HMAC-SHA256 signatures with timing-safe comparison to prevent replay and forgery attacks.
Analytics and crash reporting are opt-in. The application collects no usage data unless you explicitly enable it in Settings → Privacy. When enabled, no email content or personal identifiers are included.
Remote e-signature is off by default. When you enable it, a document sent for signature is AES-256-GCM encrypted on your machine before upload; the decryption key travels only in the signer's link and never reaches our servers, so JARVOS cannot read the document. The encrypted copy is deleted after signing, and within 48 hours regardless.
If you discover a security vulnerability in JARVOS, please report it privately before public disclosure. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues within 14 days.
security@jarvos.site — please encrypt sensitive reports with our PGP key (available on request).
We do not currently offer a bug bounty program. We do publicly acknowledge researchers who report valid issues, with their permission.