SYSTEM / SECURITY MODEL
Security at the boundaries
The public model is intentionally concrete: what the client stores, what crosses the network, what authority a session carries, and what happens when a required protection cannot be verified.
Four enforcement layers
- 01
Client
Credentials use an operating-system vault when available, with an owner-only file fallback. Configuration and diagnostics are deliberately bounded and redacted.
- 02
Transport
Remote service and authorization endpoints require verified HTTPS. Plain HTTP is restricted to exact loopback development hosts.
- 03
Authority
The client discovers server capabilities, requests explicit scopes, and keeps consent, session refresh, revocation, and account deletion visible.
- 04
Service
Sensitive data uses versioned encryption envelopes and protected workloads verify their required data-protection state before accepting work.
Data handling by class
| Data | Public handling contract |
|---|---|
| Credentials | Protected local storage, least-privilege scopes, redaction, revocation, and account-bound state. |
| Microphone audio | Captured in memory by the CLI, sent over authenticated transport for transcription, and never written to a local temporary file. |
| Dietary context | Consent-gated sync, encrypted sensitive records, explicit household scope, and deletion paths. |
| Health context | Separate opt-in consent, owner-only access, encrypted OAuth tokens and daily rollups, bounded retention, provider labels, and purge on revocation. |
| Diagnostics | Structural request information only; tokens, keys, queries, profiles, phone numbers, and request bodies are excluded. |
Health integrations keep separate trust boundaries
Oura is connected through OAuth and its server-held tokens are encrypted. Apple Health can only be read by the iOS app; the app may upload four daily aggregates after separate health-sync consent. Raw HealthKit samples, workouts, locations, and sub-day timestamps are not uploaded through this path.
Synced Apple Health rows are owner-only, retained for 90 days, and deleted in the same transaction that revokes health consent. Health values are excluded from operational logs, and health-context responses are marked no-store.
Protected work fails closed
The service hardening program uses ciphertext-shape enforcement, transport verification, separated workload authority, and current runtime attestations for protected paths. If a required check cannot be established, the operation stops rather than falling back to plaintext storage or weaker transport.
This program is ongoing. We describe deployed behavior and public contracts here; internal key identifiers, service topology, thresholds, and operational evidence remain private.
Voice is explicit about its processor
The microphone scope is checked before capture begins. Native audio is processed by hello.food and its configured transcription provider. A browser speech processor is a separate fallback and requires an explicit disclosure and consent. Typed input remains available.
The release path is part of the model
- Public process and JSON contracts are versioned and fixture-tested.
- Resolved dependencies are audited in CI.
- Published Python artifacts use trusted publishing and attestations.
- The Rust program adds cross-platform checks, dependency policy, provenance checks, and compatibility freezes before release.
- Security reports use private vulnerability disclosure rather than public issues.