Security

A personal AI
that can't betray you.

VAND is the first AI built so it structurally cannot sell you out. Everything you tell it lives in a single AES-256-GCM encrypted file on your Mac. The key is generated locally and wrapped by your OS keychain, or by your passphrase if you turn that on. There is no VAND server, no account, no sync, no telemetry — nothing to leak, nothing to subpoena.

What follows is exactly what's in the app today, not a roadmap. Every line is backed by source files linked at the bottom of this page.

The stack
Data file format
AES-256-GCM. 96-bit random IV per write, 128-bit auth tag, atomic temp+rename writes.
Key wrapping (default)
A 32-byte AES key is generated locally with crypto.randomBytes and wrapped by Electron safeStorage, backed by macOS Keychain, Windows DPAPI, or Linux libsecret.
Key wrapping (opt-in)
You can switch the key wrapper to your passphrase (PBKDF2-SHA256, 200,000 iterations, 16-byte random salt). The OS keychain leaves the trust chain entirely.
Lock screen
Optional passphrase + Touch ID. When pwd-mode is on, Touch ID alone is disabled, typing the passphrase is required to derive the data key.
Auto-lock
Optional system-wide idle timeout (1 / 5 / 15 / 30 / 60 min). Polls Electron's powerMonitor, fires after the threshold, blocks all IPC until unlocked.
Network use at rest
None. The renderer is loaded via file://; the local AI bridge talks to 127.0.0.1 only; the auto-updater hits a public release feed when packaged.
What an attacker would need

Someone borrows your unlocked Mac for a minute

If you enabled the lock screen, they hit the passphrase / Touch ID gate before any data renders. Cmd+L locks on demand; auto-lock locks after the idle window you chose.

Someone steals your drive image

vand.json is encrypted at rest. To decrypt it they need the wrapped AES key, which, in the default mode, sits inside the OS keychain and only opens for the active OS user session.

Malware running as you on your Mac

In default safe-mode, malware can call safeStorage as you and unwrap the key. In opt-in pwd-mode, this attack fails, the key is locked behind PBKDF2(passphrase) and never sits unwrapped at rest.

Cloud breach of any third party

Impossible. VAND has no accounts, no servers, no sync, and no telemetry. The only network traffic is the download itself, the update check, and the one-time AI model fetch.

How you can verify any of this

VAND is unsigned for now, the install instructions at /download explain the one-time macOS Gatekeeper prompt. Paid signing is optional future polish, not a security gate.

What VAND deliberately doesn't have
  • No accounts.
  • No sync. No cloud.
  • No telemetry. No analytics SDK.
  • No ad networks.
  • No third-party AI calls (Ollama runs on 127.0.0.1).
  • No data export to any VAND server, ever.
Found something?

Email vand.app.ai@gmail.com with details. Please don't open public issues for security reports.

No bug bounty yet, VAND is bootstrapped. A polite credit in the changelog and a heartfelt thank-you are on offer.