JARVOS is a local-first application. Your most sensitive data — email content, credentials, contacts — never leaves your machine. This page describes the security measures applied to data that does cross a boundary.
IMAP and SMTP passwords are encrypted with AES-256-GCM before being written to your local database. The encryption key is stored in your OS keychain (Windows Credential Manager / macOS Keychain / libsecret on Linux) — never in config files or environment variables.
Your email, WhatsApp messages, and contacts are stored in a SQLite database on your machine. Nothing is transmitted to JARVOS servers. JARVOS does not have a copy of your data and cannot access it.
Sessions are authenticated with JWTs signed with a server-side secret, and every API endpoint verifies the signature on each request. In the desktop app, credentials are held in your OS keychain. The web account portal stores its session token in your browser's local storage so you stay signed in between visits.
JARVOS performs a daily VACUUM INTO backup of your local database and records a SHA-256 hash of each backup file. A weekly integrity check re-hashes the most recent backup and compares it against the stored hash to detect any corruption.
All incoming webhooks (Stripe, Meta Cloud API, QuickBooks, Xero) are verified using HMAC-SHA256 signatures with timing-safe comparison to prevent replay and forgery attacks.
Analytics and crash reporting are opt-in. The application collects no usage data unless you explicitly enable it in Settings → Privacy. When enabled, no email content or personal identifiers are included.
If you discover a security vulnerability in JARVOS, please report it privately before public disclosure. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues within 14 days.
security@jarvos.site — please encrypt sensitive reports with our PGP key (available on request).
We do not currently offer a bug bounty program. We do publicly acknowledge researchers who report valid issues, with their permission.