Security Overview

The Vibe Sensei desktop application runs all AI orchestration, code processing, and voice audio locally on your machine. We have no visibility into the content of your prompts, agent outputs, or the files you work with. This is not a policy commitment — it is a structural property of how the product works.

Passwords are hashed with bcrypt before storage. We never store plaintext credentials.

All communication between the desktop app and our backend is encrypted in transit via TLS (HTTPS).

Access to production databases is restricted to authorized personnel. We apply the principle of least privilege to infrastructure access.

When you connect a messaging integration (such as Slack), the OAuth bot token is stored encrypted at rest using AES-256-GCM. The encrypted token is never exposed to the desktop application or to any AI model — it is used only by our backend to relay messages on your behalf.

We do not resell, share, or use your provider tokens for any purpose other than operating the integration you configured.

You can revoke integration access at any time from the desktop app settings or from the provider's own dashboard (e.g. Slack Manage Apps).

We collect only what is necessary to operate the service: your email address, hashed password, subscription status, and anonymous aggregate usage counts. See our Privacy Policy for the full data inventory.

If you discover a security issue, please report it responsibly to security@vibesensei.ai. We will acknowledge receipt within 3 business days and keep you informed of our progress. We ask that you do not publicly disclose the issue until we have had time to address it.

To request deletion of your account or integration data, email support@vibesensei.ai. We complete deletion requests within 30 days, except where retention is required by law.