Local processing, defined

Ordinary work-context models run locally. Local evidence and connected-account caches use encrypted storage; source permissions, profile scope, access and expiry checks constrain retrieval. Encryption does not make a compromised or unlocked Mac safe from all access.

Account/authentication, billing, downloads, provider APIs, enabled diagnostics and support are network services. Updated pattern embeddings are local-only; older builds can differ. We do not promise every service is offline.

Connected-account protection

• Google authorization uses the native sign-in SDK, not a password field inside adsideō.
• Only read-only Gmail/Calendar access is requested by the current connector. Each account is scoped independently.
• Authorization archives are protected in device-local, non-synchronizing Keychain storage; tokens are not placed in the mail-source cache or routine logs.
• The cache uses encrypted bounded pages and resumable transactions. Storage limits pause work rather than grant broader permissions.
• Disconnect and source revocation are distinct from deletion of external provider copies.

Capture, voices and diagnostics

Monitoring controls and exclusions reduce capture, but user permission cannot replace participant notice or consent. Persistent voice recognition needs additional safeguards; see the voice-data notice.

Updated builds default optional diagnostic uploads off. The upload endpoint requires the current consent marker, a signed-in account, a bounded payload and allowlisted metadata; free-text logs are rejected. Local exports may contain filtered logs and must be reviewed before sharing. Opting out cancels pending app uploads but does not itself erase an already uploaded report.

What is not certified

We do not claim SOC 2, ISO 27001, HIPAA certification, unrestricted global compliance, Google verification, biometric recognition accuracy, or zero security risk. No public statement substitutes for impact assessments, vendor agreements, access-control testing, incident response or independent review.

The website is public; the previous statement about password-protected pre-launch access is not a current security control. See providers and the Privacy Policy for network boundaries.

Report a vulnerability

Email support@adsideo.ai with subject “Security report”, affected version, minimal reproduction and impact. Do not include passwords, tokens or other people's content. Do not access unrelated accounts, disrupt systems or assume a testing authorization or paid bounty exists. Ask for a secure channel before sending sensitive evidence.

We investigate reports and provide legally required breach notices. Reporting an issue does not guarantee a fixed resolution time; the operational escalation process must be verified before broad release.