Security

Last updated: July 31, 2026

Your corpus stays on your device. This page lists what can leave, channel by channel; most channels are off until you turn them on. (For the legal policy, see Privacy.)

Where your data lives

commissure indexes content from your external sources into a corpus stored under ~/.commissure on your device. Searching and browsing your corpus happen on your device; nothing is sent anywhere to do it. The corpus is never uploaded wholesale. The only server-side copy that can exist is the optional encrypted backup below, encrypted on your device before it leaves: ciphertext we cannot read.

What can leave your device

The channels below are the app's own; the System tab is the canonical live view, with each channel's state and controls. Separately, using commissure.ai involves ordinary account records: your email, passkey public keys, and session and usage metadata (never the content of your messages), covered under Accounts and Payments. Everything that leaves your device is encrypted in transit (TLS).

Cloud messages: when you use a cloud model, your message and the corpus snippets needed to answer it go to the model you chose (Anthropic, OpenAI, Google, or Commissure credits). A local model sends nothing anywhere. Every run records a trace on your device: prompt, context, cost.
Synced account data: the data you choose to sync from your device (your rules, your items, and the coordination reading), sent one way to your commissure.ai account and stored so your account page can show it. On demand, off by default, clearable any time.
Encrypted backup: your corpus and kernel databases, encrypted on your device before upload (scrypt then AES-256-GCM). The server holds the encrypted chunks and the routing details (chunk list, sizes, and the key-derivation parameters, never the key): enough to store and meter, never to read. Your passphrase never leaves your device; without it there is no recovery, by design.
Capture mailbox: one-liners you send from a signed-in device (a watch dictation, a quick note). The cloud holds them until your device collects them, then they are marked claimed and swept.
Ask relay: currently disabled for every account; it returns once its consent names the exact model and scope. When enabled, a message from your signed-in device goes to your device, is answered against your local corpus, and the answer comes back; the corpus is never sent to a server, and the mailbox copy is deleted on delivery. Your Mac must be awake to answer.

The commissure.ai chat

The chat on commissure.ai answers questions about commissure. It can see your account info (email, plan, usage) and nothing else: not your corpus, not your synced data, nothing on your device. We do not store the content of your messages to it.

Accounts and keys

Your account uses passkeys (WebAuthn), so there is no password to store, reuse, or leak, and money-moving actions require a passkey check, not just a logged-in session. API keys live in the macOS Keychain or your environment; the app, its databases, and its backups store references, never values.

Payments

Payments are processed by Stripe. We never see or store card numbers. The account server stores your email, tier, and credit ledger.

The app

The Mac app is Developer-ID signed and notarized by Apple, and every release is verified against its published SHA-256 digest before the site serves it. Reading your local mail, messages, and notes requires Full Disk Access, granted by you in System Settings and used only to build your local corpus. The dashboard serves on localhost and requires a per-user session: another account on the same Mac cannot open yours.

Services we rely on

Cloudflare (site, accounts, storage) · Stripe (payments) · Resend (email) · Twilio (invite texts) · the model you pick for cloud messages. Each receives only what its row above describes.

Reporting & breach notice

Report a security issue: nik@commissure.ai. If a breach affects your data, we will notify affected accounts without undue delay.

← back to commissure