Security

JARVOS is a local-first application. Your most sensitive data — email content, credentials, contacts — never leaves your machine. This page describes the security measures applied to data that does cross a boundary.

AES-256-GCM Credential Encryption

IMAP and SMTP passwords are encrypted with AES-256-GCM before being written to your local database. The encryption key is stored in your OS keychain (Windows Credential Manager / macOS Keychain / libsecret on Linux) — never in config files or environment variables.

Local-First Data Model

Your email, WhatsApp messages, and contacts are stored in a SQLite database on your machine. Nothing is transmitted to JARVOS servers. JARVOS does not have a copy of your data and cannot access it.

Signed Authentication Tokens

Sessions are authenticated with JWTs signed with a server-side secret, and every API endpoint verifies the signature on each request. In the desktop app, credentials are held in your OS keychain. The web account portal stores its session token in your browser's local storage so you stay signed in between visits.

Automated Backup Integrity

JARVOS performs a daily VACUUM INTO backup of your local database and records a SHA-256 hash of each backup file. A weekly integrity check re-hashes the most recent backup and compares it against the stored hash to detect any corruption.

Webhook Signature Verification

All incoming webhooks (Stripe, Meta Cloud API, QuickBooks, Xero) are verified using HMAC-SHA256 signatures with timing-safe comparison to prevent replay and forgery attacks.

No Telemetry by Default

Analytics and crash reporting are opt-in. The application collects no usage data unless you explicitly enable it in Settings → Privacy. When enabled, no email content or personal identifiers are included.

Responsible Disclosure

If you discover a security vulnerability in JARVOS, please report it privately before public disclosure. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues within 14 days.

security@jarvos.site — please encrypt sensitive reports with our PGP key (available on request).

We do not currently offer a bug bounty program. We do publicly acknowledge researchers who report valid issues, with their permission.

What JARVOS will never do

  • Store your email passwords in plaintext on disk
  • Transmit your email content, contacts, or documents to JARVOS servers
  • Sell or share your data with third parties
  • Access your machine remotely or execute code on your behalf without explicit user action
  • Silently disable telemetry opt-out preferences