SECURITY CENTER
Security boundaries you can explain.
Side Whisper separates public marketing, authenticated account data, protected downloads, the Electron privileged bridge, remote web content, local browser state, and local voice processing.
- Website
- Clerk, Convex, Vercel, Resend, and protected server routes
- Desktop
- Context isolation, typed IPC, minimal preloads, trusted-sender checks
- Voice
- Local recording, conversion, transcription, correction, and paste
- Telemetry
- No automatic desktop usage telemetry or uploaded game metrics
THE BOUNDARIES
What is trusted, what is isolated, and what stays local.
Authenticated account data
Clerk proves browser identity. Convex functions enforce user, admin, device, and entitlement authorization on the server.
Protected operations
Build downloads, admin upload/delete routes, device changes, and entitlement mutations perform their own access checks.
Electron privilege isolation
Context isolation stays enabled. Remote pages never receive the full Side Whisper privileged bridge.
Local browser and voice state
Website sessions, browsing history, saved links, settings, permissions, recordings, transcripts, and game telemetry stay on the PC.
Abuse and token controls
Public tokens are high entropy, hashed, expiring, shape validated, and protected by atomic rate limits.
Release integrity
Protected builds expose a SHA-256 checksum, while Store packages follow Microsoft-managed delivery and update rules.
LOCAL DATA SUMMARY
The account backend does not need your browsing life.
Side Whisper’s service layer is for identity, consent, access, devices, sessions, waitlist operations, and release delivery. It is not a sync backend for browser history, website cookies, transcripts, or performance telemetry.
- No uploaded browser history or page content
- No uploaded website-session exports
- No uploaded microphone recordings or transcripts
- No automatic desktop analytics
- No uploaded local crash dumps
- No uploaded FPS, GPU, CPU, RAM, or temperature telemetry
2026 WEB HARDENING
Security is a maintained checklist, not a launch badge.
The website security baseline is documented against current Next.js guidance, Clerk server-side authorization guidance, OWASP ASVS 5.0, OWASP file-upload controls, Microsoft Store policy, and EU privacy and digital-content obligations.
- Content Security Policy and strict transport headers
- Server-side authorization at each protected data boundary
- Rate limits, generic public responses, and token rotation
- Input, file, URL, and redirect validation
- Dependency, secret, logging, backup, and incident review
- Accessibility-tree and agent-friendly semantic verification