Security

Last updated: 12 November 2026

Svara can see your screen, type into apps and act for you, so it's built to ask before it does anything that matters, and to keep what it learns on your Mac.

How Svara protects you

• Keys stay in the Keychain. API keys, your ChatGPT sign-in and tool servers' tokens are stored in your Mac's Keychain, never in plain files or settings, and never shown in full after you save them.
• You approve actions. Moving or renaming files, putting them in the Trash, calendar changes, reminders, notes, Mail drafts, Shortcuts, shell commands, pictures, reading a web page, and tools from connected servers wait for your OK. Svara never sends an email or message by itself.
• Routines can't act. Routines run without a window, so there's no one to approve: any action they try is declined.
• Links can't take over. A svara:// link from a web page or another app can only fill in a prompt or open a panel. Starting the microphone or running a routine from a link asks you first.
• Secrets stay out of reach. The AI's file tools refuse files that hold keys or passwords, such as .ssh, .aws, .env and *.pem, whatever a page or email tells it.
• Links in answers open only on the web or in Mail, never as a command, a file or a system setting.
• Python runs in a sandbox with no network, no access to your home folder, other temporary files, other disks or the clipboard, and no way to control other apps.
• Passwords are skipped. Svara never copies from a password field, and clipboard history skips items that password managers mark as private.
• Updates are signed. Svara only installs updates signed with our update key, downloaded over HTTPS.
• Text from the web is data, not instructions. Svara tells the AI to treat pages, emails, files and tool results as content. Because a web page can still try to trick an AI, every action it suggests still needs your approval, routines don't search the web, and reading a link refuses addresses on your Mac or local network, including through redirects.
• Tool servers ask too. A connected server's tool runs without asking only if the server says it just reads and doesn't reach the internet.

What you can do

• Leave "Run writes and commands without asking" (Settings → Agent) off unless you trust every prompt you send.
• Only add tool servers (MCP) you trust; they run with your permissions.
• Give Svara only the macOS permissions you need. Each one is optional and can be removed in System Settings → Privacy & Security.
• Keep Svara up to date.

Power use

Svara sits in the background all day, so it's built to stay light. The avatar draws about 10 frames a second when calm, 4 while it sleeps and almost none while your screens are off, and only speeds up while Svara is working or you touch it. The sound engine rests between sounds. Watched folders are only read again when a file changes, and closed windows stop their checks. Speech, search and translation run on your Mac's own chips where they can. If Svara ever uses noticeable power while you aren't using it, please tell us.

Report a problem

If you find a security problem, write to [security@svara.bot] with what you found and how to reproduce it. Please give us a reasonable time to fix it before you make it public. We'll reply within a few working days and credit you if you like.