TRUST CENTER

Security at Qolvivo

No customer API keys

All AI requests pass through authenticated server endpoints. Provider keys are runtime secrets and are never embedded in the Mac or Windows application or sent to customers.

Account protection

Customer sign-in is handled through Supabase Auth using short-lived sessions, secure cookies, passwordless email links, and explicitly configured Google, Apple, or Facebook identity. Server routes verify the current user before accessing account, billing, or device data.

Scoped desktop access

Both apps require microphone access to record after the chosen shortcut. Mac uses Accessibility for insertion; Windows uses a global keyboard hook and temporary clipboard paste. Both clients block known secure fields, prevent wrong-window insertion, and delete temporary recovery audio after each request.

Token handling

Desktop access tokens are generated through an expiring device-code flow, stored in macOS Keychain or Windows Credential Manager, hashed at rest on the service, individually revocable, and never written to application logs.

Data minimization

Audio is streamed for processing and is not intentionally retained by Qolvivo. Text history is optional. Billing data is tokenized by Stripe. Operational logs should contain request identifiers and outcomes, not dictated content.

Reporting

Report a suspected vulnerability to security@saywright.app. Please include reproducible details and allow reasonable time before public disclosure.