Security
Private by architecture.
Bevel AI is built around a simple premise: the safest place for your messages is your own device, encrypted. Not a policy promise — a property of how the app is built.
The path your data takes
In, and nowhere else.
Your accounts
Gmail · Outlook · more
Local engine
127.0.0.1 only
Encrypted database
AES-128-XTS · your keys
That's the complete path today — no hop to a Bevel server in between.
Safeguards
What that means in practice.
Encrypted local database
Your messages are stored on your device in a database protected with AES-128-XTS full-database encryption. The database key is generated locally and never leaves your device in plaintext. If someone copies the database file, they get ciphertext.
Secrets in the OS credential store
Account tokens and database keys live in your operating system's credential store — Windows Credential Manager, macOS Keychain or a Linux Secret Service keyring — not in config files or the filesystem.
Sandboxed message rendering
Message content is sanitized and rendered in a sandboxed view with remote content blocked by default. A malicious message should be an unpleasant email, not an attack surface.
No telemetry by default
The app collects no analytics and sends no usage data. There is no crash reporting unless you explicitly opt in, and this website uses no analytics or tracking scripts.
Local engine, loopback only
The local engine that syncs and indexes your messages binds to 127.0.0.1 only and requires a per-launch authentication token. Other devices on your network — and other processes without the token — cannot talk to it.
Questions
Straight answers.
Not today. Your messages live in an encrypted database on your own device, with the keys held in your operating system's credential store — there's no Bevel server holding a copy right now. If that changes, for a feature like cross-device sync, it'll be disclosed clearly before it happens, not assumed.
Responsible disclosurePlaceholder
We are setting up a responsible disclosure process and a dedicated security contact — both are to be determined and this section is a placeholder. Until a contact is published, please do not report potential vulnerabilities in public channels. If you believe you have found a security issue, hold the details and we will publish a reporting address before the first public beta.