Security
Security
Zero-knowledge architecture. Your code stays on your machine. Our server stores nothing.
Architecture Overview
Plexon AI's security model is built on architectural constraints, not policy promises. The system has three components: a local Plexon background process that runs on your machine, a desktop application for the user interface, and a stateless server that routes AI requests to your chosen provider.
Your code is processed entirely by the local Plexon background process. It reads files, executes tools, manages sessions, and handles all file operations using 30 concurrent workers. The server component never receives your source code. It receives only the AI conversation context (your prompt and the AI's response stream) and immediately discards it after processing. There is no database, no file storage, no cache, and no logging on the server side.
On Your Machine
File ops, sessions, tools, encryption. All data stays here.
Stateless Server
AI routing only. Processes and forgets. Zero storage.
AI Provider
Your chosen provider (Anthropic, OpenAI, Qwen, etc.) with your API key.
Data Flow
You type a request in the desktop app. The local Plexon background process reads relevant files from your project directory and assembles the context.
Plexon sends the prompt (not your files) to the stateless server. Your API key is encrypted with AES-256-GCM before transmission.
The server assembles 31 system prompt sections, routes to your AI provider (Anthropic, OpenAI, Google, Qwen, etc.), and streams the response back via SSE.
The server immediately releases all memory. No data is written to disk, logged, cached, or retained in any form. The request ceases to exist.
The local daemon applies code changes with git-blob checkpoint backups (5-10ms) so you can always roll back. Session history is encrypted and stored locally.
Security Features
AES-256-GCM Encryption
All local sessions and API keys are encrypted with AES-256-GCM, a NIST-approved authenticated encryption standard. API keys are auto-encrypted during JSON marshaling before any network transmission. Session data at rest is encrypted using a machine-specific key derived from your system credentials.
Session Lock and App Lock (Premium)
Lock an individual chat and its messages are encrypted with a key derived from a passcode you choose, not from your machine credentials, so nothing opens that chat without it. Plexon cannot reset a forgotten session passcode. Touch ID on macOS and Windows Hello on Windows open the same chat key, released by the operating system after a check. A locked chat is refused by export and by Live Share until you unlock it. A separate app lock asks for a passcode or a biometric before the window becomes usable on launch: that one is a gate against someone sitting at your desk, not disk encryption, which remains the job of FileVault or BitLocker. It can also come back after a stretch with no typing or clicking, from one minute to three and a half hours, and a chat that is mid-answer keeps running while the screen is locked. Clearing the app lock with the PIN opens any chat locked with that same PIN; a biometric unlock opens the app only, because the check returns no PIN to match. You can also cap how many wrong PINs Plexon accepts, counted across the gate and every locked chat together: reach the limit and Plexon deletes everything it keeps on this machine and restarts as a fresh install. That one is off by default, the lowest limit is 5, and any correct PIN or biometric check clears the count. Turning a lock on needs Premium. Unlocking, changing a passcode, and removing a lock work on any plan.
Encrypted Transfer Bundles
Moving a Plexon setup to another computer writes one file sealed under a passphrase you choose at export time. Plexon stores that passphrase nowhere, which is also why nobody can reset it and why a recovery code is offered beside it. The bundle carries the credentials your connectors use, so it is handled as secret material end to end: records are read out of the local store and written straight into the sealed stream, never to a temporary file on the way. No Plexon server sees the file, the passphrase, or the contents, and no account holds a copy. A sealed bundle does describe itself before you unlock it, because the import screen has to say what a file is before asking for a passphrase: category names, item counts, total size, the source hostname, and the creation date are readable, while paths, filenames, connector names, project folders, and every byte of content are not.
Stateless Server Architecture
Our server maintains zero state between requests. No sessions, no code, no prompts, no logs are stored. Each request is processed in isolation: the server assembles 31 dynamic system prompt sections, routes the request to your chosen AI provider, streams the response, and immediately releases all memory. Server-side data breaches are architecturally impossible because there is no data to breach.
Zero Data Retention
All request data is discarded immediately after response generation. The server operates as a pure stateless AI processing orchestrator with no database, no file storage, no caching layer, and no logging infrastructure. We cannot retrieve your data because we never store it. This is not a policy. It is an architectural constraint.
OAuth2 PKCE Authentication
Plexon supports OAuth2 with Proof Key for Code Exchange (PKCE) for Anthropic API authentication and MCP tool authorization. PKCE prevents authorization code interception attacks without requiring a client secret. Enterprise SSO integration is available for Team and Enterprise tiers, supporting SAML 2.0 and OpenID Connect.
Command Blocklist
Dangerous system commands are blocked by default through a configurable blocklist. Commands like rm -rf, format, and shutdown are prevented unless explicitly allowed in your project configuration. The blocklist is enforced at the Plexon background process level before any command reaches the operating system, providing a reliable safety net against destructive AI-generated operations.
Fine-Grained Permission Controls
Every potentially destructive action requires explicit user approval. Browser automation asks before navigating to new URLs. The Desktop Automation connector requires approval for mouse and keyboard control. File operations are sandboxed to your project directory. MCP tool calls display the action and parameters for your review before execution. You maintain complete control over what the AI can and cannot do.
Horizontal Scalability
The stateless server design means no session affinity, no single point of data compromise, and the ability to scale horizontally without architectural changes. Each server instance is identical and interchangeable. This also means on-premises deployment is straightforward: no database migrations, no state synchronization, no complex clustering.
Encryption Details
Enterprise Security
Enterprise and Team tiers include additional security capabilities for organizational deployments:
- SSO / OAuth2 PKCE: Single sign-on integration with your identity provider
- On-premises deployment: Run the stateless server on your own infrastructure
- Centralized API key management: Team-wide API key distribution and rotation
- Dedicated server infrastructure: Isolated compute for your organization
- SLA guarantee: Uptime commitments with premium support
Security Questions or Reports?
For security vulnerabilities or concerns, contact us at security@plexon.ai
We take all security reports seriously and will respond within 48 hours.