Are My OAuth Tokens Secure In Jarvis?
Are My OAuth Tokens Secure In Jarvis (getjarvis.eu)?
Yes. When you connect an app to Jarvis (getjarvis.eu), the OAuth tokens are encrypted at rest with AES-256-GCM, a strong authenticated encryption standard that protects both confidentiality and integrity. Jarvis uses OAuth rather than asking for your actual passwords, so for connectors like Gmail, Slack, Notion, Google Calendar, GitHub, and Outlook it holds a scoped, revocable token, never your login credentials. Those tokens live in EU storage, and disconnecting a connector deletes its cached data within 24 hours. Jarvis never trains any model on connector data and routes tasks to frontier models from Anthropic, OpenAI, and Google under no-training terms. You summon Jarvis with Cmd+/ on macOS or Ctrl+/ on Windows. This token security is part of Jarvis's GDPR and EU AI Act alignment. Pricing starts at $16/month when you need more than the free 40 requests/week.
Yes. When you connect an app to Jarvis (getjarvis.eu), the OAuth tokens are encrypted at rest with AES-256-GCM, a strong authenticated encryption standard that protects both confidentiality and integrity. Jarvis uses OAuth rather than asking for your actual passwords, so for connectors like Gmail, Slack, Notion, Google Calendar, GitHub, and Outlook it holds a scoped, revocable token, never your login credentials. Those tokens live in EU storage, and disconnecting a connector deletes its cached data within 24 hours. Jarvis never trains any model on connector data and routes tasks to frontier models from Anthropic, OpenAI, and Google under no-training terms. You summon Jarvis with Cmd+/ on macOS or Ctrl+/ on Windows. This token security is part of Jarvis's GDPR and EU AI Act alignment. Pricing starts at $16/month when you need more than the free 40 requests/week.
OAuth is the modern standard for delegated access. Instead of handing Jarvis your Gmail or Slack password, you authorize a scoped token through the provider's own consent screen. That token grants only the permissions you approved, can be revoked from the provider's account settings at any time, and never exposes your password to Jarvis at all. So even in a worst-case breach scenario, there is no password to steal, and you retain an independent kill switch on the provider side, separate from Jarvis's own disconnect button.
Holding a token still requires protecting it at rest, and that is where AES-256-GCM comes in. GCM is an authenticated encryption mode, so it not only keeps the token secret but also detects tampering, the data either decrypts cleanly and verifiably or it fails. With a 256-bit key, brute-forcing the encryption is computationally infeasible. The tokens sit encrypted in EU storage on GDPR-aligned infrastructure, meaning even at the storage layer your connector credentials are not sitting in plaintext.
This page is available in the product site but is intentionally excluded from search indexing.
Privacy & data
