Security Overview
Architectural principles, encryption standards, and responsible vulnerability disclosure.
1. Our Security Commitment
GlossAI is designed to provide AI-powered desktop assistance while respecting the privacy and security of user information. Desktop assistants may process sensitive information displayed on a user's computer, so security and privacy are important considerations in our architecture.
2. Application Architecture
The current intended architecture includes Tauri 2, a React and TypeScript frontend, native macOS and Windows integrations, Supabase authentication and backend infrastructure, and OpenRouter AI model routing. Confirm that this description remains accurate for the production release.
3. Account Security
GlossAI uses authentication mechanisms designed to protect user accounts. Implemented architecture has included email-based authentication, secure authentication callbacks, session management and token refresh, operating-system secure storage for authentication tokens where supported, and backend authorization and user-specific database access controls. Confirm platform coverage and production configuration before representing each control as active.
4. Data Protection
GlossAI is designed to protect information through appropriate technical and organizational measures. Intended measures include HTTPS/TLS network communication where supported; protected authentication sessions; backend access restrictions; database access controls; separation of user-specific information; and secure handling of application credentials. Encryption-at-rest settings, backup protections, key management, and provider configurations must be verified before making specific claims.
5. Screen Privacy
The intended interaction model is user-initiated access to content for AI assistance. GlossAI should access only screen content required for the feature being activated. Users should be able to manage relevant operating-system permissions and disable screen-related functionality. Screen content may be transmitted to authorized AI processing providers when necessary to generate a response. For complete disclosures, see our Screen Privacy Disclosures.
6. AI Service Security
GlossAI uses AI infrastructure to process user requests. Requests may pass through OpenRouter and the selected model provider. Security and privacy practices may differ between providers and models. Users should avoid submitting highly confidential information unless authorized and aware of applicable provider policies.
7. Access Control
GlossAI uses backend authentication and authorization to restrict access to account-specific information. Database security policies are intended to prevent users from accessing another user's private account information and conversations. Administrative access should be limited to authorized personnel and protected through appropriate access controls. Validate policies and administrative access in production.
8. Vulnerability Management
We aim to maintain application security through dependency updates, code reviews, application testing, backend security reviews, access-control testing, bug investigation and remediation, and updates to supported desktop components. Describe only processes that are actually followed.
9. Security Incidents
If we identify a security incident affecting user information, we will investigate and take appropriate steps to contain and address it. Where required, affected users and relevant authorities will be notified in accordance with applicable law.
10. User Security Recommendations
We recommend that users keep GlossAI updated; use strong authentication credentials; protect their computer with a secure login; review operating-system permissions; avoid submitting passwords and highly sensitive information; sign out on shared computers; and report suspected vulnerabilities or unauthorized access.
11. Responsible Disclosure
We welcome responsible reports of security vulnerabilities. Reports should include a description of the issue and steps to reproduce it, without accessing, modifying, or disclosing other users' information.
12. Scope and Updates
This overview describes intended architecture and practices. It is not a certification, independent security audit, or guarantee that vulnerabilities do not exist. We will update this document as security controls and infrastructure evolve.