Security

Darwin

• Runs locally. Files and conversations stay on your device; no analytics.
• Browser sign-in with OAuth and PKCE; the session is stored in the macOS Keychain.
• Previewed web pages run in a sandbox.

Trace

• Data and processing in Mumbai, India.
• Passwordless sign-in, with a second factor for administrators.
• Access checked per organisation and role on every request.
• Append-only, hash-chained audit log for each organisation.
• Original files fingerprinted (SHA-256) and never modified.

Report a vulnerability

Email security@ekpyros.com with a description and steps to reproduce. Please do not disclose it publicly until we have fixed it. We acknowledge reports within two business days.

We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and uses only your own accounts.