Security

Security and privacy are core to how ARIA OS is built. This page summarizes the main protections in place. For how we handle data more broadly, see our Privacy Policy.

Encryption

Data is encrypted in transit using HTTPS/TLS. Sensitive data is encrypted at rest. Your model keys and integration credentials are stored encrypted and are never returned to the browser or exposed in the client app — they are used only server-side to perform the actions you request.

Per-user isolation

Every account’s data is isolated using row-level security rules enforced at the database. Requests are scoped to your workspace, so one account cannot read or write another account’s data.

Local-first by design

The desktop app does its work on your machine. Your files stay local, and the desktop ships only public configuration — not the secret keys that power privileged operations. When you enable backup, your memory and chat history are mirrored to a private GitHub repository that you own and can inspect.

Payments

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We never see or store your full card number.

Responsible disclosure

If you discover a security vulnerability, please report it to ar.dev@anshulraman.com before disclosing it publicly. Include enough detail to reproduce the issue. We appreciate good-faith reports and will work to address valid issues promptly.