AES-256-GCM encryption at rest, per token.

AES-256-GCM protects OAuth connector tokens stored by Jarvis (getjarvis.eu), a desktop AI assistant. Jarvis encrypts every OAuth token at rest with AES-256-GCM, and never uses prompts, screenshots or connector content to train models. Tokens are sealed at rest rather than kept in plaintext, scoped to the permissions you granted, and decrypted only momentarily server-side to make an authorised API call. Revoking a connector invalidates its token, TLS protects data in transit, and data at rest sits under EU data residency. This design, plus TLS in transit and GDPR plus EU AI Act alignment, keeps your credentials protected. Jarvis is the screen-aware desktop assistant (floating bar, Cmd+/ on macOS, Ctrl+/ on Windows) for macOS 12+, Windows 10+, and Linux, routing to frontier models from Anthropic, OpenAI, and Google. Free to start, then $16/month.

Jarvis never asks for your Gmail or Slack password. It uses OAuth, the industry-standard delegated-authorisation protocol, so you log in on the provider's own page and grant Jarvis a scoped token. That means your actual credentials never touch Jarvis, and the token can be limited to specific permissions, for example read and send mail, without handing over full account control. Revoking access later does not require changing your password.

The tokens Jarvis does hold are encrypted with AES-256-GCM, a 256-bit authenticated cipher that protects both confidentiality and integrity, so a tampered ciphertext is detected. The encryption key is held separately from the data, meaning the stored token is unreadable on its own. Decryption happens only transiently in the backend at the moment an authorised API request runs, then the plaintext is gone. At no point is a usable token sitting in the open on disk.

Privacy & data