Security & Trust

Security by design

A context-aware assistant shouldn't compromise your privacy. Explore Maple's zero-knowledge local architecture, encryption protocols, and data boundaries.

Local-First Indexing

All raw text, transcriptions, and indexing pipelines are executed on your physical machine. Your databases never sit on our servers.

Zero LLM Training

We do not train model layers on user queries, screens, or documents. Partner API connectors enforce strict Zero-Data-Retention policies.

On-Device Encryption

Your local indices are encrypted with AES-256-GCM. Decryption keys reside inside your OS Keychain (Windows Credential Manager / macOS Keychain).

1. On-Device Sandboxing

Maple runs as a lightweight native desktop daemon using a secure Rust-based core compiled with Tauri. By executing processes locally, we contain sensitive operations within your OS security boundary:

  • Whisper.cpp Transcription: Audio capture from your meetings is processed locally via quantized speech-to-text libraries. No raw audio files are ever uploaded.
  • Local Vector Databases: Semantic search models run on your desktop CPU/GPU using ONNX Runtime. Indices are managed locally in high-performance SQLite databases.

2. Zero-Knowledge Key Management

Decryption keys are generated dynamically during initial setup using cryptographically secure random number generators. Maple has zero access to these keys:

  • Keys are stored locally within the **Windows Credential Manager** or **macOS Keychain**.
  • The desktop application requests access from the OS key vault only at startup.
  • We do not maintain a master key recovery mechanism. If local keys are deleted or corrupted, your database remains unrecoverable, keeping your secrets safe from unauthorized access.

3. Network & Data Flow

When you query the assistant to summarize or format data, Maple follows a highly structured, secure communication flow:

1

Context Isolation

Maple retrieves relevant vectors and documents from your local SQLite database using your OS-decrypted keys.

2

PII Anonymization

Before leaving the device, raw context passes through local regex filters designed to scrub detected API tokens, credentials, and passwords.

3

Zero-Retention Querying

The scrubbed query is packaged and sent via TLS 1.3 to LLM provider gateways. All API hooks utilize Enterprise agreements with **Zero-Data-Retention (ZDR)** parameters, ensuring providers discard your logs immediately.

4. App Exclusions & Ignore Rules

Maple gives you granular control over what gets mapped into your context engine. Exclude directories, specific applications, or sensitive workflows:

  • Default Blacklists: Password managers, incognito browser pages, banking applications, and terminal windows are ignored automatically by the OS window listeners.
  • Custom Exclusion Rules: Define specific directories, URL regex patterns, or calendar invites to permanently bypass from indexation.

Security & Compliance

Need details on self-hosting, SOC 2 compliance, or custom VPC isolation audits?

mapledotso@gmail.com