Security
Security
The short version: your files never reach us, and the questions you send are gone the moment they are answered. The long version, with the algorithms and the exact route your data takes, is below.
How It Fits Together
We built it so we cannot read your data, rather than promising we will not. There are three parts: a background process that runs on your machine, the app window you look at, and a stateless server that passes AI requests on to the service you picked.
Your files are handled entirely by the background process on your own machine. It reads them, runs the tools, and keeps your conversations. The server never receives your files. It receives only the conversation itself, your question and the reply coming back, and lets go of it as soon as the reply is sent. There is no database, no file storage, no cache, and no logging on the server side.
On Your Machine
Your files, your chats, your tools, all encrypted. Nothing leaves.
Our Server
Passes the question on, then forgets it. Nothing is stored.
The AI Service
Whichever you picked (Anthropic, OpenAI, Qwen and others), on your own account.
Data Flow
You type a request in the app. The background process on your machine reads whatever files are relevant and puts the question together.
Plexon sends the question to our server, and not your files. The keys to your AI accounts are encrypted with AES-256-GCM before they go anywhere.
The server builds the instructions for the AI, passes the request to the service you picked (Anthropic, OpenAI, Google, Qwen and others), and streams the reply back over TLS 1.3.
The server immediately releases all memory. No data is written to disk, logged, cached, or retained in any form. The request ceases to exist.
The background process applies the changes on your machine, taking a restore point first. Nothing it does is one-way. Your conversation history is encrypted and stored locally.
Security Features
AES-256-GCM Encryption
All local sessions and API keys are encrypted with AES-256-GCM, a NIST-approved authenticated encryption standard. API keys are auto-encrypted during JSON marshaling before any network transmission. Session data at rest is encrypted using a machine-specific key derived from your system credentials.
Session Lock and App Lock (Pro)
Lock an individual chat and its messages are encrypted with a key derived from a passcode you choose, not from your machine credentials, so nothing opens that chat without it. Plexon cannot reset a forgotten session passcode. Touch ID on macOS and Windows Hello on Windows open the same chat key, released by the operating system after a check. A locked chat is refused by export and by Live Share until you unlock it. A separate app lock asks for a passcode or a biometric before the window becomes usable on launch: that one is a gate against someone sitting at your desk, not disk encryption, which remains the job of FileVault or BitLocker. It can also come back after a stretch with no typing or clicking, from one minute to three and a half hours, and a chat that is mid-answer keeps running while the screen is locked. Clearing the app lock with the PIN opens any chat locked with that same PIN; a biometric unlock opens the app only, because the check returns no PIN to match. You can also cap how many wrong PINs Plexon accepts, counted across the gate and every locked chat together: reach the limit and Plexon deletes everything it keeps on this machine and restarts as a fresh install. That one is off by default, the lowest limit is 5, and any correct PIN or biometric check clears the count. Turning a lock on needs Pro. Unlocking, changing a passcode, and removing a lock work on any plan.
Encrypted Transfer Bundles
Moving a Plexon setup to another computer writes one file sealed under a passphrase you choose at export time. Plexon stores that passphrase nowhere, which is also why nobody can reset it and why a recovery code is offered beside it. The bundle carries the credentials your connectors use, so it is handled as secret material end to end: records are read out of the local store and written straight into the sealed stream, never to a temporary file on the way. No Plexon server sees the file, the passphrase, or the contents, and no account holds a copy. A sealed bundle does describe itself before you unlock it, because the import screen has to say what a file is before asking for a passphrase: category names, item counts, total size, the source hostname, and the creation date are readable, while paths, filenames, connector names, project folders, and every byte of content are not.
Stateless Server Architecture
Our server keeps nothing between one request and the next. No conversations, no files, no questions, no logs. Each request is handled on its own: the server builds the instructions for the AI, passes the request to the service you picked, streams the reply back, and lets go of all of it. A breach on our side could not expose your data, because your data is not there to take.
Zero Data Retention
Everything about a request is dropped the moment the reply is sent. The server has no database, no file storage, no cache and no logs. We could not hand over your data if we were asked, because we never had it. This is not a policy we could change our minds about. It is how the thing is built.
OAuth2 PKCE Authentication
Signing in to Anthropic, and authorising the tools Plexon connects to, uses OAuth2 with Proof Key for Code Exchange (PKCE). PKCE stops an intercepted authorization code from being usable, without needing a client secret. Team and Enterprise plans can use your own single sign-on, over SAML 2.0 or OpenID Connect.
Command Blocklist
Commands that could wreck your machine are blocked by default, and you decide what goes on the list. Things like rm -rf, format and shutdown are refused unless you allow them for a project. Plexon stops them itself, before they ever reach the operating system, so a wrong move by the AI cannot destroy anything.
Fine-Grained Permission Controls
Anything that could do damage waits for you to say yes. It asks before opening a new web page, before taking over your mouse and keyboard, and it can only touch files inside the folder you pointed it at. Every tool call shows you what it is about to do, and with what, before it does it. Nothing happens behind your back.
Run It On Your Own Servers
Because the server keeps nothing, every copy of it is identical and interchangeable, and there is no single place where your data could be taken from. It also makes running it yourself simple: nothing to migrate, nothing to keep in sync between copies, no clustering to set up.
Encryption Details
Enterprise Security
Team and Enterprise plans add a few things companies tend to need:
- Single sign-on: your staff sign in the same way they sign in to everything else, over SAML 2.0 or OpenID Connect
- Run it yourself: the server can run on your own hardware
- Keys held centrally: hand out and rotate the AI account keys for the whole team from one place
- Machines of your own: servers that run nobody else’s work but yours
- An uptime guarantee: a written commitment, with support to match
Security Questions or Reports?
For security vulnerabilities or concerns, contact us at security@plexon.ai
We take all security reports seriously and will respond within 48 hours.