A Digital Fortress
Your trust is not negotiable. Every layer of my architecture is designed to protect what belongs to you — your data, your identity, your privacy.
The Military Standard (Libsodium)
All of your data, our conversations and our local databases are encrypted with the Libsodium cryptographic library — XChaCha20-Poly1305 algorithm, Argon2id key derivation. A standard historically reserved for highly restricted mobile environments, which I've brought straight to your desktop computer. Only your master password can unlock it.
Ed25519-Signed Updates v3.0.0
Every Lara update is cryptographically signed with an Ed25519 key — the most robust elliptic-curve signature algorithm available. Before applying any update, my OTA system verifies the signature's authenticity. An unsigned or tampered update gets rejected, no exceptions: nobody can push unauthorized code to you, not even by intercepting your connection.
End-to-End Encrypted Remote Access v4.24.0
The paid Remote Access option — disabled by default — connects your browser to your PC via a cloud relay that never sees your messages in plaintext: every message is encrypted end-to-end (crypto_box, Libsodium) directly between the two endpoints. No persistent trace on the browser side by default (session token kept in tab memory only, purged on close); an explicit checkbox lets you remember it — on your own device only.
Two-Factor Verification & Recognized Devices v4.31.0
On Remote Access, turn on two-factor verification (2FA): until a browser has cleared a code or a passkey, it never gets easier access. A dedicated screen lists your recognized devices (revocable one by one) and your full connection history — who connected, when, and from which device.
Independent Security Audit (Snyk) v4.32.5
An automated security audit (source code and dependency analysis) went through the desktop app and mobile apps line by line, with concrete results. Fixes made: an open redirect and an XSS flaw in the mobile update flow, two XSS flaws on the cloud services login pages, a disabled server key check re-enabled on the backup script, a rate limit added on sensitive mobile API endpoints, and several minor hardenings (response headers, input validation).
Consent-gated screen sharing, never silent v4.42.0
Whether shared locally with the AI or via Remote Access, screen sharing stays disabled by default and requires an explicit setting. Every start triggers a dedicated consent prompt — never auto-accepted — with a persistent visual banner while sharing is active, so you always know when your screen is visible.
Built-in WireGuard VPN
My installer automatically configures a WireGuard tunnel on your machine. All communications between your computer and your mobile devices pass through this encrypted tunnel. Your personal network becomes a private enclave, shielded from outside view.
GDPR Compliance
European legislation strictly regulates the handling of personal data. Strict consent is required before waking me up, and your Privacy-by-Design policy is honored to the letter. Your privacy preferences stay under your control, at all times.
100% Local Intelligence
Unlike mainstream assistants, I operate in a sealed environment. None of our conversations, none of your requests ever leave this device to be analyzed in the Cloud. My intelligence is entirely contained within your premises — and nowhere else.
Encrypted Local Learning v4.8.0
My self-learning from feedback stays confined to your machine: lessons drawn from your feedback and the learned profile live in a sealed container, encrypted with the same libsodium key as the database. No feedback, no lesson ever leaves your device — I learn on your premises, and nowhere else.
Isolation per Conversation
Each conversation has its own isolated memory space. My agents only access documents and context explicitly shared within a given session. The wall between your exchanges is guaranteed architecturally, not merely by policy.