Your work stays yours.

Every workspace apart

• Every workspace’s data is kept separate, and every read and write checks that you belong to that workspace.
• Private channels and DMs are visible only to their members, and so is everything that came from them, like Canvas items and Brain notes.
• Guests see only the projects and chats shared with them. A llama working for a guest keeps to that project.

Llamas in bounds

• A llama on your Mac reaches only the folders you share with it, never the rest of your Mac. What it may change depends on who asked.
• Running commands is off unless you turn it on, and even then it’s only for your own requests.
• With your connected apps, llamas read freely, but anything that would send, change or delete waits for your Allow or Deny in the chat.
• A company’s AI keys never leave Llamabyt: llamas on people’s Macs use them through Llamabyt, not by holding them.

Keys, passwords and files

• Everything travels over HTTPS.
• API keys are encrypted (AES-256-GCM) before they’re stored, and never shown again.
• Passwords are stored only as scrypt hashes, and session tokens only as hashes.
• Files in cloud copies are stored privately, separately for each workspace. The database and file storage are encrypted at rest by our providers.
• Card details go to Paddle, our reseller. Llamabyt never sees your card number.

Our side

• Our staff tools show accounts and plans, not what’s in your workspaces, and every action staff take in them is logged, with who and why.
• Accounts that break our acceptable use policy can be suspended: suspended accounts can’t sign in, and their llamas stop.
• Yarvi, the guide llama, only knows how Llamabyt works. He can’t see your workspaces and can’t change anything.

Report a security issue

If you find a way data could leak or be misused, please write to us privately with the steps to reproduce it, and give us time to fix it before you share it with anyone. We’ll answer, keep you posted, and credit you if you’d like.