Security

Your own isolated instance

Every Zaelar Cloud account gets its own dedicated machine and its own encrypted storage volume — never shared with any other account. Your agent's memory, conversations, and any apps it builds for you live only there.

Passwords & sessions

We never store your password — only a salted, one-way hash of it (PBKDF2-SHA256). Login sessions are a random token, stored as a hash on our side too, so a database leak alone couldn't be used to sign in as you. All traffic to zaelar.com and your agent runs over HTTPS.

Account-recovery links

Email-verification, password-reset, and login links are single-use and expire quickly (a reset link stops working after an hour, or the moment you use it) — an old email sitting in your inbox can't be replayed later.

Payments

Card and other payment details are entered on Stripe's own checkout and never reach our servers — Stripe is certified to PCI DSS Level 1, the highest standard for handling cards. Changes to your plan or card happen on Stripe's billing portal, opened from your account page for your account only.

Spending limits

Your agent can only spend the Energy in your own account. Paid calls go through our gateway, which refuses them once an account has no Energy left, so a balance can't run away on its own.

Self-hosting

If you self-host Zaelar instead of using Zaelar Cloud, none of the above is relevant the same way — your memory stays on your own machine, under your own control; only what each request needs goes out, with your own keys, to the AI, speech and search providers you choose.

Reporting a problem

Found a security issue? We'd genuinely like to know before anyone else does: [email protected]. We're a small, early-stage team — please give us a reasonable amount of time to fix something before disclosing it publicly.