Security
Security
The short version: your files never reach us, and the questions you send are gone the moment they are answered. The long version, with the algorithms and the exact route your data takes, is below.
How It Fits Together
We built it so we cannot read your data, rather than promising we will not. There are three parts: a background process that runs on your machine, the app window you look at, and a stateless server that passes AI requests on to the service you picked.
Your files are handled entirely by the background process on your own machine. It reads them, runs the tools, and keeps your conversations. The server never receives your files. It receives only the conversation itself, your question and the reply coming back, and lets go of it as soon as the reply is sent. There is no database, no file storage, no cache, and no logging on the server side.
On Your Machine
Your files, your chats, your tools, all encrypted. Nothing leaves.
Our Server
Passes the question on, then forgets it. Nothing is stored.
The AI Service
The Plexon AI included with your plan, or another service on your own account.
Data Flow
You type a request in the app. The background process on your machine reads whatever files are relevant and puts the question together.
Plexon sends the question to our server, and not your files. Everything on that trip is encrypted before it leaves your machine.
The server builds the instructions for the AI, passes the request on, and streams the reply back over TLS 1.3.
The server immediately releases all memory. No data is written to disk, logged, cached, or retained in any form. The request ceases to exist.
The background process applies the changes on your machine, taking a restore point first. Nothing it does is one-way. Your conversation history is encrypted and stored locally.
Security Features
AES-256-GCM Encryption
Your chats and the sign-ins you save for connected apps are encrypted with AES-256-GCM, a NIST-approved authenticated encryption standard. The key is derived from your own machine, so those files are unreadable on any other computer. Nothing is written to disk in the clear.
Session Lock and App Lock
Lock an individual chat and its messages are encrypted with a key derived from a passcode you choose, not from your machine credentials, so nothing opens that chat without it. Plexon cannot reset a forgotten session passcode. Touch ID on macOS and Windows Hello on Windows open the same chat key, released by the operating system after a check. A locked chat is refused by export and by Live Share until you unlock it. A separate app lock asks for a passcode or a biometric before the window becomes usable on launch: that one is a gate against someone sitting at your desk, not disk encryption, which remains the job of FileVault or BitLocker. It can also come back after a stretch with no typing or clicking, from one minute to three and a half hours, and a chat that is mid-answer keeps running while the screen is locked. Clearing the app lock with the PIN opens any chat locked with that same PIN; a biometric unlock opens the app only, because the check returns no PIN to match. You can also cap how many wrong PINs Plexon accepts, counted across the gate and every locked chat together: reach the limit and Plexon deletes everything it keeps on this machine and restarts as a fresh install. That one is off by default, the lowest limit is 5, and any correct PIN or biometric check clears the count. Turning a lock on needs Pro. Unlocking, changing a passcode, and removing a lock work on any plan.
Encrypted Transfer Bundles
Moving a Plexon setup to another computer writes one file sealed under a passphrase you choose at export time. Plexon stores that passphrase nowhere, which is also why nobody can reset it and why a recovery code is offered beside it. The bundle carries the credentials your connectors use, so it is handled as secret material end to end: records are read out of the local store and written straight into the sealed stream, never to a temporary file on the way. No Plexon server sees the file, the passphrase, or the contents, and no account holds a copy. A sealed bundle does describe itself before you unlock it, because the import screen has to say what a file is before asking for a passphrase: category names, item counts, total size, the source hostname, and the creation date are readable, while paths, filenames, connector names, project folders, and every byte of content are not.
Stateless Server Architecture
Our server keeps nothing between one request and the next. No conversations, no files, no questions, no logs. Each request is handled on its own: the server builds the instructions for the AI, passes the request to the service you picked, streams the reply back, and lets go of all of it. A breach on our side could not expose your data, because your data is not there to take.
Zero Data Retention
Everything about a request is dropped the moment the reply is sent. The server has no database, no file storage, no cache and no logs. We could not hand over your data if we were asked, because we never had it. This is not a policy we could change our minds about. It is how the thing is built.
OAuth2 PKCE Authentication
Signing in to Anthropic, and authorising the tools Plexon connects to, uses OAuth2 with Proof Key for Code Exchange (PKCE). PKCE stops an intercepted authorization code from being usable, without needing a client secret. A company on its own plan can use its own single sign-on, over SAML 2.0 or OpenID Connect.
Command Blocklist
Commands that could wreck your machine are blocked by default, and you decide what goes on the list. Things like rm -rf, format and shutdown are refused unless you allow them for a project. Plexon stops them itself, before they ever reach the operating system, so a wrong move by the AI cannot destroy anything.
Fine-Grained Permission Controls
Anything that could do damage waits for you to say yes. It asks before opening a new web page, before taking over your mouse and keyboard, and it can only touch files inside the folder you pointed it at. Every tool call shows you what it is about to do, and with what, before it does it. Nothing happens behind your back.
Encryption Details
Company Security
A company does not buy the standard Pro or Premium plan. It buys its own, at prices agreed with us, and that plan brings the company its own bundle. What that adds:
- Single sign-on: your staff sign in the same way they sign in to everything else, over SAML 2.0 or OpenID Connect
- A bundle only your people can read: with protected delivery, the company’s read-only access token never reaches a member’s machine, and the installed items are encrypted at rest under a key only a signed-in member the marketplace is granted to receives
- One connector for everyone: a company connector ships inside the bundle and knows who is signed in, so no member configures it and no member handles the company’s own credentials
- A staff side that stays private: the internal company page and its marketplace open only to accounts in the company’s own user group, and never appear in search
Security Questions or Reports?
For security vulnerabilities or concerns, contact us at contact@hellenic.dev
We take all security reports seriously and will respond within 48 hours.