Security & data

Access

The panel is single-user and opens with an access code. A successful sign-in sets one session cookie — claudian_session, httpOnly, SameSite=Lax, Secure over HTTPS, 60 days. Repeated failed attempts are rate limited.

Permissions

Each AI surface authenticates separately over OAuth 2.0 with PKCE and holds its own scoped token. Scopes are stored per token, not shared between surfaces, and revoking one does not touch the others.

Read and write are separate grants and are never bundled. A model is given the smallest relevant piece of the vault rather than the vault. Deletion is never granted to a model.

Writes are reversible

Writes are targeted edits to Markdown files, not whole-file overwrites. If the folder is a git repository — the recommended setup — every write is a commit you can read, diff and revert. Alongside that, an audit log at ~/.claudian/audit.jsonl records the operation, the file, the timestamp and the reason it was written.

Keys and secrets

Where a provider requires an API key, it is yours: it stays on your machine and is never bundled into a note or sent to another provider. Secrets are kept out of the vault by the write test — raw chat, credentials and transient state are not memory and are not written down.

Transport

Public traffic is served over HTTPS with TLS terminated at the edge; the application itself listens on localhost behind a tunnel and is not exposed directly. Responses carry a strict Content-Security-Policy, HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict referrer policy, and a permissions policy that denies camera, microphone, geolocation and payment.

What Claudian does not do

• It does not upload, sync or back up your vault to a server.
• It does not load third-party analytics, advertising or tracking scripts.
• It does not grant a model deletion rights, ever.
• It does not write to your vault without an approved scope.

Testing

Twelve acceptance suites run before a release — covering adapters, recurrence, panel state, vault writes, budget limits, connection handling, rate limits, core behaviour, durability, remote MCP access and shutdown. They are part of the repository, not a claim about it.

Since 1.0.0: what was closed

• Spoken words cannot make Claudian act. Notes from Yüzük recordings are written by one call with no tools; the answer must match a fixed structure, and Claudian builds the note itself and neutralises anything Obsidian could run. ChatGPT and Gemini, when chosen, run on your computer (through Codex and the Antigravity CLI) with every tool switched off: they cannot read files, run commands or search the web.
• The writing key stays in the cloud. It is not in the app, the phone app or any download. New devices and computers wait for approval, each has a quota, and spending limits are recognised.
• Only the account that created a job can read or delete it.
• The engine installer unpacks only what the publisher signed, pins every other download to a checksum, and never writes into Program Files.
• Local network receiver removed, port closed, and the leftover firewall rules were deleted.
• Account deletion from the phone app and on the web (claudian.app/yuzuk/hesap-sil).

Knowingly still open

• The Windows installer is not Authenticode-signed. Updates are verified with the publisher's Ed25519 signature, but Windows shows "Unknown publisher" on first install.
• The Mac application is not yet notarized by Apple. Updates use the same Ed25519 release signature; macOS asks you to allow the first launch under Privacy & Security.
• New computers reach the cloud through Cloudflare's quick tunnel, a testing feature without an uptime guarantee.
• The admin panel and the engine's tunnel are not yet behind Cloudflare Access. The admin panel stays closed until then.
• Legal compliance is not settled. The consent of people near a recording, Turkish data protection law (KVKK), voiceprints as biometric data and Google Play's Data Safety form still need a lawyer's review. Nothing on this page is that review.

Reporting a problem

If you find a security issue, please report it privately and give a reasonable window for a fix before disclosing it publicly.