Security & trust
Your keys. Your code. Your data.
We’re a small team being direct about what matters most: here is exactly what we do, and don’t do, with your code and your conversations.
Protected companion communication
Vyohm uses authenticated, encrypted transport for activation, approvals, progress updates, and questions between your devices and the companion service.
Bring your own key
Use your own API key and your requests go straight from your machine to your chosen model provider, while plan features still govern workflow capacity, approvals, visibility, and support.
Device-bound licenses
Activation ties your license to the specific installation that activated it. If a device is lost or compromised, contact us to revoke or rotate its access.
BYOK data flow
How your code moves when you bring your own key
With BYOK, your source code goes from your machine to the provider you configured, and nowhere else. If that provider is unavailable, the run fails — we do not quietly finish it on our own infrastructure.
Activation and companion approval flows route through Vyohm using authenticated, encrypted transport — your BYOK source-code traffic does not. A self-managed deployment can choose to complete a failed BYOK call on Shaktii infrastructure instead of failing it; that setting is off unless an operator turns it on.
Data boundaries
The honest list
-
Your repositoryYour workspace stays on your machine. We do not upload, clone, or retain your source tree, and a run’s code context is processed in memory and not kept afterward.
-
Your API keys in plaintextKeys are encrypted at rest and only decrypted at the point of use, on your device where possible.
-
Your Vyohm chat messagesMessages between people are end-to-end encrypted on your device. We relay and store them as ciphertext and hold no key that opens them — which is also why in-chat search cannot read them.
-
Progress detail in push notificationsA notification says what kind of thing happened and for which project. It never carries the text of an update, because a push leaves our systems for Apple and Google to deliver.
What we do hold
Shakti sends Vyohm a running commentary so you can follow a project away from the editor — what an agent is doing, what a task moved to, what finished. That text is written by the agents about your work, and on the default configuration it reaches our servers readable, is stored, and can be read by the service in order to render your thread. It is not end-to-end encrypted, and we are not going to describe it as though it were.
Two controls exist today for teams that want less to cross. A deployment can reduce that commentary to structural information only — project, event kind, timestamps, no prose — and can encrypt what is stored so a database copy is useless without a key we hold separately. Both are off unless an operator turns them on. Making the service itself unable to read this content is work we have not shipped, and we will say so here on the day it changes.
We’re early — if you find a gap between this page and reality, tell us. It’s the fastest way to make both better. The full detail lives in our Privacy Policy.
Questions about our security model
Reach the team directly — we answer security questions personally, before you sign up if you’d like.