Security and data
Local by architecture, honest about the edges
Your PC
Business data, uploaded documents, the SQLite database and the working context live on the Windows PC where Tayl is installed.
Cloud LLM
If you choose a cloud provider, query content is sent to that provider with your key. The provider's terms apply. A local LLM avoids that cloud request.
No compliance badge
Tayl does not claim SOC 2, ISO 27001, GDPR or HIPAA certification on this site. Local-first is an architecture description, not a certificate.
Security overview
Tayl is a desktop application, not a hosted service. The app connects to the tools you authorise, reads the records you choose, and keeps its working data in a local SQLite database on your machine. There is no Tayl-hosted backend for user data.
The website is a separate marketing site hosted on Vercel. It has no user accounts. It collects an email address for the download gate and the details you submit through the contact form.
This page does not claim application-level encryption, penetration-test results, uptime guarantees or a security certification. Those claims should only appear when they are true and verifiable.
How data flows
In the desktop app
- Connected-tool records are read through the provider's API and stored locally.
- Uploaded documents are processed on your PC and their extracted context is stored in the local database.
- Questions are answered from that local context. The answer and its evidence remain in the app.
- If you use a cloud LLM, the query content is sent to the provider you chose.
On this website
- The download form sends an email address to a submissions webhook configured by the site owner.
- The contact form sends your name, email, topic and message to the same kind of webhook.
- Vercel Analytics is cookie-less and does not use advertising identifiers.
- There are no user accounts and no marketing trackers on this site.
What is sent to third parties
| Action | What leaves your machine | Who receives it |
|---|---|---|
| Visiting this website | Standard request data and cookie-less analytics events | Vercel (hosting and analytics) |
| Requesting the download | The email address you submit | The site owner's submissions webhook |
| Using the contact form | Name, email, topic and message | The site owner's submissions webhook |
| Using a cloud LLM | The content of your query | The LLM provider you chose |
| Connecting a tool | API requests authorised by your account | Google, Notion, Stripe or Slack, as applicable |
| Uploading a document | Nothing is sent to Tayl; processing is local | Your PC |
Each connected tool and LLM provider is the user's own account and is governed by that provider's terms. Tayl is not affiliated with or endorsed by any of the tool providers named on this site.
Responsible AI
Tayl is designed to ground answers in the data it has and to show the evidence behind them. The product should say honestly when there is not enough evidence to answer a question. A decision should require evidence, not just a fluent paragraph.
Language models can be wrong, incomplete or out of date even when the evidence is present. Treat every answer as something to check, especially before it affects money, customers or legal obligations. You remain the decision-maker.
The product does not claim to eliminate bias, hallucinations or errors. The commitment is to evidence, traceability and an honest statement of uncertainty.
Report a vulnerability
If you believe you have found a security issue in Tayl or this website, use the contact form and choose Other. Include “security” in the message, a description of the issue and enough detail to reproduce it. Do not include passwords, API keys or confidential business documents.
A dedicated security contact address is not published yet; the contact form is the reliable route.
A machine-readable contact is published at /.well-known/security.txt. No bug bounty or response-time guarantee is offered unless separately announced.
More detail
Read the privacy policy for website data, retention and deletion, and the Terms of Use for the software licence. The documentation explains how to remove local data.
Questions about data handling?
Ask us directly. We would rather answer than have you guess.
Contact us