Security and The Data
Security and Control
Security and control begin with knowing where workspace data is stored and which operation can move it. Protect the sources, project knowledge, and AI conversations in the workspace. These guides explain device access, connected services, credentials, and backup recovery. For a blank panel, missing chat, or failed import, use Support.
Who Can Read Work Saved on This Computer?
The saved sources, projects, extracted insights, and local AI chat history are stored in the browser profile where you use SecondMindOS. Someone with access to the unlocked computer account may be able to open that profile and read this work.
Use a separate operating-system account on a shared computer and lock the session when unattended. A separate browser profile organizes work but does not provide a password-protected vault.
Signing into the SecondMindOS website does not encrypt the local library with the backup passphrase. The privacy page explains which optional features send data to a service.
How Cloud Data Is Protected
SecondMindOS cloud connections encrypt data in transit with TLS. Raw and derived workspace content included in account sync is encrypted at rest. Account access controls restrict each account to its authorized records.
Product configuration settings remain readable to authorized SecondMindOS services so, subject to your analytics choices, they can be used to understand feature use and improve the product. They do not receive a separate application-encryption layer, although encryption at rest still protects the stored records. Saved workspace content is not used for behavioral analytics or model training.
Hosted sync is not end-to-end encrypted with the backup passphrase. Authorized SecondMindOS services process synchronized records to provide account sync and other enabled hosted features. A signed-in device receives the records authorized for that account without needing a backup passphrase.
Cloud backup contents receive another encryption layer on the device before upload. This passphrase protection is separate from the provider-managed encryption used for hosted application data. A different device must receive the original backup passphrase from the user before it can decrypt and restore that backup.
Connection Permissions
Check which account the provider shows during setup and limit access in that provider when the provider offers page, folder, server, or channel choices. Connecting a service does not add the content to SecondMindOS.
Enter an API key only in the integration’s dedicated credential field. Do not paste an API key into an ordinary note or AI chat. Keep keys out of screenshots and support reports.
Disconnect an integration when continued provider access is no longer required. Files or pages already copied to the provider stay there. If you think a key was exposed, follow the API-key instructions; disconnecting alone does not invalidate that key.
Checks Before Sending Or Restoring Data
Check the destination and the action named on the button before execution. The current product uses different confirmation steps for different tasks.
- For Add Context, confirm the Destination name and selected file before clicking Add Context.
- For a Drive restore, use Preview Restore and check the displayed item counts before clicking Restore.
- For cloud AI, check the selected provider and use Review Context before sending. This review is optional; Send does not require a separate approval dialog.
If the destination or result is unclear, cancel the action. Do not assume that a Connect or Check Connection button imports, exports, or changes content.
Backup Passphrase Protection
The passphrase encrypts Google Drive backup contents before upload. Backup encryption does not encrypt the live browser library, ordinary Markdown exports, or JSON files created through Download Backup.
Keep the passphrase used for each backup in a password manager. An older backup still needs the original passphrase, even if workspace owners use a new one for later backups. SecondMindOS cannot recover a lost passphrase.
Remembering a passphrase saves the secret in extension-private browser storage. Forgetting a passphrase removes the remembered secret without deleting the uploaded backup. See A Drive backup cannot be unlocked if you cannot open a copy.
A Device Was Lost Or Stolen
Use another trusted device for these steps. This situation is different from simply opening the wrong browser profile.
- Use the device or operating-system account’s controls to lock the missing device, if that option is available.
- Review the accounts that were signed in on the missing device. Use each provider’s controls to sign out the missing device or revoke the sessions where available.
- To recover SecondMindOS work, use a JSON or Drive backup workspace owners already have. A website sign-in alone cannot retrieve chats stored only on the missing computer.
If an API key or remembered backup passphrase may also have been accessible, handle that secret separately. Revoke an exposed API key. A new backup passphrase does not change old encrypted copies.
An API Key Was Accidentally Shared
Use this if a key appeared in a public post, shared screenshot, message, or file.
- Open the provider account where you created the key. Revoke or delete the exposed key there.
- If you still need the integration, create a replacement key and enter the replacement key in SecondMindOS’s dedicated field for that provider.
- Check the provider’s usage history for unexpected activity. Remove the exposed copy from the shared location too.
The old key must be invalidated at the provider. Deleting a screenshot or disconnecting SecondMindOS does not make an exposed key secret again. Do not send either key to support.
Report a Security Issue
Email security@secondmindos.app when SecondMindOS appears to have allowed access or a change outside the expected permission boundary.
- Describe the expected behavior and the observed result, including the page or feature involved.
- Include the browser and extension versions, approximate time, and reproduction steps using controlled accounts and example data.
- Remove keys, sign-in links, passphrases, and private content from any screenshot or example.
After unexpectedly seeing information from another account, stop accessing the unexpected information and describe the observation without downloading or forwarding the records. For ordinary product errors, use support.