Security

Your own isolated instance

Every Zaelar Cloud account gets its own dedicated machine and its own encrypted storage volume — never shared with any other account. Your agent's memory, conversations, and any widgets it builds for you live only there.

Passwords & sessions

We never store your password — only a salted, one-way hash of it (PBKDF2-SHA256). Login sessions are a random token, stored as a hash on our side too, so a database leak alone couldn't be used to sign in as you. All traffic to zaelar.com and your agent runs over HTTPS.

Account-recovery links

Email-verification, password-reset, and login links are single-use and expire quickly (a reset link stops working after an hour, or the moment you use it) — an old email sitting in your inbox can't be replayed later.

Self-hosting

If you self-host Zaelar instead of using Zaelar Cloud, none of the above is relevant the same way — your data stays on your own machine, under your own control, end to end.

Reporting a problem

Found a security issue? We'd genuinely like to know before anyone else does: [email protected]. We're a small, early-stage team — please give us a reasonable amount of time to fix something before disclosing it publicly.