Security

• Agents run on your computer. Your conversations with them, your AI model connections and keys, meeting recordings and your device's private key stay there.
• Watched folders stay on your device by default. For a folder you choose to share, the server keeps a search list of its files; the original files are not uploaded.
• What your team shares in the workspace — messages, files, boards, documents, tasks and calendars — is kept on the workspace server.
• Workspace servers, databases, file storage and backups run on the company's own server in the Republic of Korea.
• Cloudflare is used only to resolve the hardiai.com domain name (DNS). Your requests and data do not pass through Cloudflare.

• Agents call AI models through the provider account you connected yourself, such as a Claude or ChatGPT subscription or your own API key. That traffic goes from your device to the provider and does not pass through our servers.
• Our servers do not call AI models, and we do not train AI models on your data.

• Traffic between the app and our server is encrypted with TLS.
• Tokens for connected services and calendar subscription addresses are encrypted with AES-256-GCM and bound to their workspace and connection.
• Google refresh tokens are never sent to devices.
• Device keys are kept in the operating system keychain. On Windows, they are in a file encrypted with DPAPI that only your Windows account can open.
• Data on the server is separated by workspace, and access is limited by role.
• Administrative actions are recorded in a hash chain, so a change to a past record shows.

• There is no password. You sign in with a one-time code sent to your email, or with your Google account.
• A sign-in code works once, for 10 minutes, and the server keeps only a hash of it.
• Access tokens last 15 minutes and refresh tokens 30 days.

• The operator console does not show the contents of your messages, files or documents.
• The exceptions: a reported message, which an operator can open only after re-entering their password, with each opening recorded; samples from workspaces whose admin turned on 'Help improve Hardi', which is off by default; and feedback you send us yourself.
• We do not use personal information for advertising, and we do not sell it.

Only the providers below process personal information on our behalf. Apart from them, we send no personal information abroad.

• AppleUnited States

  Notifications for the iPhone app. Apple gets the device's push token and a wake-up signal with no content.

• GoogleUnited States

  Notifications for the Android app (the same token and signal), diagnostics from the Android app's QR code scanner, and website visit statistics with Google Analytics.

• ResendUnited States

  Sends sign-in codes and service emails.

• PaddleUnited Kingdom

  Will process card payments as the seller of those orders. Card payment is not open yet, so nothing is sent to Paddle today.

• Cloudflare

  Domain name resolution (DNS) for hardiai.com, and nothing else.

Hardi does not have SOC 2, ISO 27001 or any other third-party security certification yet.

If you find a security issue, email deviantcemaster@gmail.com with what you found and how to reproduce it. Please give us time to fix it before you make it public.