Please report vulnerabilities privately to the NeoLabs-Systems security contact rather than opening a public issue. Include the affected version and a minimal reproduction without real recordings or personal data.

Audio is transient server-side data and is sealed with AES-256-GCM while it waits on disk. The SQLite database is page-encrypted with the installation key in NEORECALL_HOME/data/secret.key, so transcripts, memories, and search indexes are not plaintext files. Voice embeddings are sensitive biometric-like data and are sealed again inside that database. Deployments should use TLS at the reverse proxy, restrictive permissions for NEORECALL_HOME, and a strong password (plus two-factor authentication) on every admin account. Admin is a role on a user account; admin routes accept only an interactive session, never an API key or OAuth token. Keep secret.key off backup media that already holds encrypted artifacts. NeoRecall sends audio to the configured transcription endpoint and transcript text to the configured language-model endpoint. Treat both endpoints and their credentials as part of the trusted deployment boundary; admin-supplied provider keys are encrypted at rest and never returned by the API.