The important boundaries, including what each product sends, what it does not send, and where a current beta still has limits.
ClassEve-hosted web and API traffic uses HTTPS. Public origins use HSTS, restrictive browser security headers, rate limits, and abuse controls. Self-hosted developer tools that bind to loopback are not remote services; operators must add their own authenticated TLS boundary before exposing one to a network.
Android builds are signed with ClassEve’s release keystore, so Android verifies the publisher and refuses an update signed by anyone else. Play-distributed builds carry Google Play’s signing on top of that.
On Windows, SmartScreen can show a publisher prompt the first time a new build runs — choose More info, then Run anyway, and check the file against its published SHA-256.
Every desktop artifact is published with its exact version, byte size and SHA-256 on its download page, so a downloaded file can be checked against what we published.
Browser sessions use signed, short-lived access tokens. Paired native apps use revocable per-device credentials. Users can review and revoke devices in the dashboard, and the consumer limit is five active devices.
A refresh credential is a bearer secret until rotated, expired, or revoked. Current clients do not claim hardware-bound proof on every platform, so protecting the device and operating-system account remains part of the security boundary.
On shipped platforms, the speech model processes microphone audio on the device. ClassEve account, model-download, entitlement, and token refresh requests do not include microphone audio or transcript text. Local history is controlled by the app and operating system.
The Android public beta uses Accessibility for cross-app text insertion. Android gives that service broad window-content capability; Lven uses it for focused editable fields and text delivery. Treat Accessibility as a sensitive permission and revoke it if you prefer not to use cross-app insertion.
Lven Cloud sends submitted audio over TLS for in-flight processing. ClassEve’s published policy is not to retain microphone audio or returned transcript text as server-side history after delivery.
earslate has no ClassEve account or credential broker. You provide the Gemini or OpenAI key, stored using Android’s protected credential facilities, and session audio goes directly from the device to the provider you select. ClassEve does not receive the session audio or translation.
Folio PDF renders supported documents locally and does not require a ClassEve account. Files leave the app only through an action you choose, such as Android sharing or printing.
Paddle is the Merchant of Record and handles checkout and raw payment credentials. ClassEve does not store full card numbers or CVV values. Paddle webhook signatures are verified before an entitlement change is applied, and event identifiers are deduplicated to resist replay.
Credential Airlock keeps real credentials out of ordinary prompts for cooperative clients by injecting them in a local proxy. The current same-user design is not a sandbox and cannot contain a malicious process running with the same operating-system identity. Its product page and repository state that limitation explicitly.
The dashboard provides account, device, entitlement, usage, and deletion controls. A broader access or deletion request can be sent to [email protected]. External Paddle and user-selected provider records remain subject to those providers’ controls and legal obligations.
Send a private report to [email protected] rather than opening a public issue. Include the affected URL or product, impact, reproduction steps, and a safe proof of concept. We read every report sent there and respond once we have assessed it; we do not publish a fixed response time.
The machine-readable disclosure record is at /.well-known/security.txt.