# Security — Pencel.ai

> How Pencel protects your data, and how to report a security vulnerability to us.

Canonical: https://pencel.ai/security

# Security

Last updated: October 13, 2026

## 1. How we protect your data

- **Your work stays on your computer.** Pencel stores your workspace, and the content it reads from your connected accounts, in a database on your own computer. It is not copied to our servers.

- **Encrypted sign-ins and keys.** Access tokens and API keys are encrypted with a key protected by your operating system before they are saved.

- **Encrypted connections.** Pencel talks to our servers, to AI providers and to connected services only over HTTPS (TLS).

- **You approve actions.** Pencel shows you an email or calendar change and waits for your approval before it acts, unless you chose to allow that action automatically.

- **Protected servers.** Our servers run on Amazon Web Services and hold only account, plan and billing records. Databases are encrypted at rest, and our AWS account is monitored for unusual activity.

Our [Privacy Policy](https://pencel.ai/privacy) describes what data Pencel handles and where it goes.

## 2. Report a vulnerability

If you think you have found a security problem in Pencel, email [security@pencel.ai](mailto:security@pencel.ai). Please include:

- What the problem is and where you found it

- What an attacker could do with it

- Steps to reproduce it, with screenshots or a short script if you have them

You can report anonymously. Please write in English if you can.

## 3. What we promise

- We reply within 3 business days to confirm we received your report.

- We keep you updated while we confirm and fix the problem, and tell you when the fix ships.

- With your permission, we thank you by name when we announce the fix.

## 4. What is in scope

- The Pencel desktop app for macOS, Windows and Linux

- pencel.ai, api.pencel.ai, account.pencel.ai and updates.pencel.ai

Anything not listed is out of scope. Problems in services Pencel connects to, such as Google, Microsoft, Intuit, Stripe, AWS or an AI provider, should go to that company. If you are not sure whether something is in scope, ask us first.

## 5. Testing rules

Please:

- Test only with accounts you own or have permission to use.

- Do only what you need to show the problem exists. Do not use it to get data, keep access or move to other systems.

- If you reach someone else's data, stop, tell us right away and do not keep or share it.

- Avoid anything that slows the service down or harms other users.

- Give us reasonable time to fix the problem, normally up to 90 days, before you tell anyone else about it.

These are not allowed:

- Denial of service or high-volume automated scanning

- Phishing, social engineering or physical attacks on our team or users

- Changing or deleting data that is not yours

- Large numbers of low-quality reports, such as unconfirmed scanner output

## 6. Legal safe harbor

If you follow this policy in good faith, we consider your research authorized, we will work with you to understand and fix the problem, and we will not take legal action against you for it.

## 7. Rewards

We don't run a paid bug bounty program. We are grateful for every useful report and are happy to credit you publicly.