Security & Data Protection

Per-account isolation

Every record (conversations, memories, tasks, files, clients, orders) is stored with the owner’s user id and filtered by it on the server. One account cannot read another account’s data.

Secrets stay on the server

AI and payment keys (Gemini, Mercado Pago) exist only as server environment variables. They are never sent to the browser, and public API keys are stored only as SHA-256 hashes.

Authentication & sessions

Passwords are hashed (scrypt), sessions use signed httpOnly cookies, and login is rate-limited. Administrative actions require a server-verified admin role and are written to an audit log.

Payments

Subscriptions are activated only after Mercado Pago confirms the payment through a signature-verified webhook — never just because a browser returned from checkout.

Your controls

You can export all of your data and permanently delete your account and data from Settings at any time (LGPD/GDPR rights).

Honest limits

JARVIS OS has not undergone an external security audit or certification, and we do not claim legal certifications. Voice processing uses the browser’s Web Speech engine, which may rely on the browser vendor’s cloud.