Trust Center
Security
How Chameleon Eye AI protects your data through security architecture, access control, and operational security practices. Compliance certifications are on the roadmap.
Compliance and Assurance Status
Current status of compliance programs and assurance milestones.
Early-Stage Product
SOC 2, ISO 27001, and penetration testing are planned milestones — none have been completed yet. See the compliance roadmap for timeline context.
Security Architecture
Every request passes through authentication, privacy guard, entitlement checks, and cloud consent before reaching the intelligence router.
The browser communicates only with Chameleon Eye AI-controlled API routes. No AI provider keys are exposed in the frontend. The Approved AI Route is reached only after all checks pass.
Provider Key Protection
Provider API keys remain server-side and are not embedded in desktop, web, or mobile clients.
Logging Policy
Chameleon Eye AI does not log raw private prompts, full AI responses, private files, or secrets in normal application logs. Usage metadata may be stored for billing, abuse prevention, and audit integrity.
Data Isolation
Customer data is separated by account and protected through application authorization and database access controls.
Key Security Principles
Implementation status across all major security dimensions.
No provider API keys in frontend code
ImplementedAI infrastructure credentials are held exclusively on the server. The frontend never contains or exposes any provider API key.
No provider keys in browser or desktop app
ImplementedThe web app and the desktop app do not store, transmit, or require any AI provider key at the client layer.
Server-side key management
ImplementedAll provider credentials are managed server-side, rotated on schedule, and never written to client-readable storage.
Secrets not written to logs
ImplementedLog scrubbing is applied at the server layer. API keys, tokens, and sensitive fields are redacted before any log write.
User data isolation
ImplementedEach workspace is isolated at the data layer. Queries are scoped by authenticated identity and workspace context.
API rate limiting
PlannedRate limiting is planned for the production API. It is not actively enforced in the current developer preview.
Security headers
ImplementedAll responses include X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy headers.
Cloud consent gate
ImplementedCloud analysis requires explicit user approval via the consent gate before any selected text is transmitted.
Audit log metadata
ImplementedRequest metadata — mode, timestamp, status, token count — is logged for owner review. Raw content is not logged.
Additional Security Measures
Operational and infrastructure security practices.
Transport Security
All traffic between the client and Chameleon Eye AI servers uses HTTPS/TLS. Strict-Transport-Security headers enforce TLS in production environments.
Local Private Mode
In local mode, no data is transmitted to Chameleon Eye AI or any AI provider. Processing remains on-device for maximum isolation. See Local Mode for details.
Dependency Management
Third-party dependencies are reviewed before addition. Supply chain security practices are applied to avoid introducing vulnerable or malicious packages.
Security Contact
To report a vulnerability or ask a security question, use the contact form with subject “Security Report”. A dedicated security email will be published following commercial launch.