Security

Your database records and files are stored in Convex with encryption at rest, and every request is served over TLS. The web app is delivered by Vercel. Authentication is handled by Clerk - you sign in with Google, with Apple, or with a one-time email code, so Erphele never sees or stores a password.

Every piece of data - tasks, chats, notes, memories, and files - is tied to your account and access-checked on every read and write. There is no shared workspace and no path for one user to reach another's data.

To answer you and take actions, relevant context is sent to AI models for that single request, routed through OpenRouter. Every ordinary turn - on every plan, Free included - is pinned to OpenAI-hosted endpoints, which run the chat, reasoning, and background utility work (titles, memory distillation, recall reranking, briefs). Voice messages are transcribed by Alibaba Cloud's Qwen ASR, and generated images, read-aloud speech, and the embeddings behind semantic recall run on Google's Gemini models. We never train AI on your content, we never let anyone else train on it, and we never sell your data.

Temporary chats are sent with zero-data-retention and no-data-collection flags - which means they are deliberately not pinned to OpenAI, whose endpoints are not zero-retention eligible, and route instead to whichever zero-retention host serves the same model. Use a temporary chat for anything you want maximally private. A temporary chat never runs on an account you connected, because that traffic would be governed by your provider's terms rather than these flags.

If you connect your own OpenAI key, those requests go directly to OpenAI with storage disabled. If you connect your ChatGPT subscription instead, they go to OpenAI's ChatGPT backend on your own plan. Both lanes run under your agreement with OpenAI, including its retention and training settings, which you control in that account. A key you connect is verified before it's saved, encrypted at rest, and revoked at the provider when you disconnect it or delete your account.

Computer Use lets the agent work on your own machine through the desktop app - and it is built to fail closed at every step. A new desktop can execute nothing. To trust it, you must enter a 6-digit code shown on that machine's own screen and pass a fresh identity re-verification; the code is single-use, short-lived, attempt-capped, and only its hash ever leaves the device. Each desktop holds its own cryptographic key, stored encrypted in the operating system's keychain, and signs the commands it runs.

Execution is layered: safe read-only commands can run under a standing grant you control; anything with side effects - installs, network fetches, moves, deletions - asks for your approval every time; and destructive or privilege-escalating commands (sudo, rm -rf, remote shells, and the like) are blocked outright, enforced in the desktop app itself, not just the cloud. Everything runs confined to your home folder, every command and its output is logged to your account, and a single switch (or deleting your account) kills the feature across all devices instantly.

Sites you publish live on erphele.site - a separate domain from the app, so published pages can never touch your session or cookies. Site addresses include a random suffix so nobody can squat a deceptive name, and every site can be reported and taken down if it's abusive.

Each published site keeps a daily traffic rollup for its owner - views, distinct visitors, top paths, referring hosts. Visitors are counted by a keyed pseudonym computed at our edge and rotated daily; raw IP addresses never reach our database and are never shown to the site owner. No analytics cookies, no cross-site tracking, and rollups are deleted after 90 days. See the Privacy Policy for the full description.

The app keeps a local cache (profile, recent chats, notes, tasks) so Erphele opens instantly and works offline. Cached entries expire after about 30 days, and the whole cache is wiped on sign-out and account deletion. On mobile, session credentials live in the OS keychain; on desktop, device keys are encrypted with the OS keyring.

You can see everything Erphele remembers about you (memories, people, daily briefs, notes, files) and delete any of it in a tap. In Settings → Account you can export everything as a single ZIP - with secrets and tokens stripped out, and download links that expire in 24 hours - or permanently delete your account. Deletion cuts access immediately, then removes your content from every table and storage bucket, deletes your identity at Clerk, and revokes any API key you connected.

We rely on a small set of trusted providers, each handling data only to perform its function: Clerk (authentication), Convex (database and file storage, EU - AWS eu-west-1), Vercel (web and hosted-site delivery), OpenRouter (routing of every AI request), OpenAI (chat, reasoning, and utility models for every plan, plus any account you connect yourself), Alibaba Cloud (voice transcription, Qwen ASR), Google (embeddings, image generation, speech, and private transcription via Gemini on Vertex), zero-retention model hosts for temporary chats (the host varies with the routing and is not OpenAI), Polar (billing, merchant of record), Expo (mobile push), Sentry (crash diagnostics, EU region), PostHog (product analytics, EU Cloud), Open-Meteo (weather), and OpenStreetMap / Nominatim (place search). We keep this list current: when the model behind a feature changes, this page changes with it.

Erphele is a personal assistant, not a certified system of record - so it isn't a replacement for the regulated tools your workplace requires (an EHR, a case-management system, and so on). But that's a statement about purpose, not protection: the security and privacy described here apply to every account equally, whatever you choose to keep in Erphele.

We hold ourselves to the practices on this page today, and we're investing in formal assurances as we grow - including SOC 2 and the controls our larger and more regulated users ask for. If your organization needs specific documentation, get in touch.

Erphele hosts sites our users publish, each on its own subdomain of erphele.site. Every hosted site carries a public report form at /__erphele/report - anyone viewing a page can report it in two taps, and repeated reports take a site offline automatically pending review.

To report phishing, malware, or any other abuse on a hosted site - or anything else on Erphele - email support@erphele.com. Include the full URL. We review every report and respond within 30 days, usually far sooner.

Found a vulnerability? We want to hear from you. Email support@erphele.com and we'll work with you to fix it quickly. Please give us a reasonable chance to respond before any public disclosure.