IT Security & Deployment Guide

1. What Relevare Does

Relevare is a desktop agent that observes screen and application activity on the local machine. Capture, storage, metrics, and filtering run locally. When analysis is requested, filtered text is sent to the configured AI provider. The product then surfaces workflow bottlenecks and recommendations to the user.

The product runs as a native desktop application on macOS and Windows.

2. Permissions Requested

macOS

Windows

What is never requested

• Microphone access
• Camera access
• Contacts, calendar, or mail access
• Keylogger or input monitoring
• Network access beyond the calls documented below

3. Network Calls

Relevare makes the minimum possible number of outbound calls. The full inventory is documented here.

Standard setup (free, ChatGPT sign-in)

Deep Research (paid add-on)

The Deep Research add-on runs live web search during analysis so recommendations reflect the current tool landscape rather than stale training data. It adds the two calls below on top of the standard inventory.

Deep research does not send screenshots or the local database. Search queries are filtered and shortened, but they can still reflect workflow context and should be included in a privacy review.

Organization tier

Organization enrollment adds signed policy and entitlement checks. Any dashboard or aggregate-data integration is documented and reviewed for that deployment; the public desktop release does not enable captured-data cloud sync.

Employee visibility and non-attribution are product requirements: employees must be able to see what leadership sees, and leadership does not receive named individual activity.

4. Independent Verification

You do not need to take our word for the network call inventory. You can verify it yourself.

Packet capture (macOS)

# Install Wireshark or use the built-in tcpdump
# Run during a full Relevare session including first launch

sudo tcpdump -i any -w relevare_capture.pcap host [your-machine-ip]

# Or filter to Relevare's process specifically:
lsof -i -n -P | grep -i relevare

Open the capture in Wireshark and filter by the Relevare process. A standard installation contacts Relevare for identity and updates, and OpenAI (auth.openai.com, chatgpt.com, api.openai.com) for ChatGPT sign-in and AI analysis under the user's own account. Telemetry and crash reporting appear only after opt-in. Deep Research adds web-search and research-synthesis calls when enabled.

On-device data inspection

# Database location
~/.relevare/db.sqlite

# The database is SQLCipher-encrypted. Inspect through Relevare's local
# APIs or with a SQLCipher-capable tool and the local .db-key.

# Log files
~/.relevare/relevare.YYYY-MM-DD.0.log

# Watch what the pipeline is doing in real time
tail -f ~/.relevare/relevare.*.log

You can verify directly what is stored, what the intelligence pipeline produces, and confirm that no raw screen content persists beyond the retention window.

5. Data Model

What is captured

• Screen images from the active display; other visible windows may appear
• Text content of the active window, extracted via accessibility API or OCR fallback
• Application name and window title of the active window
• Timestamps of application focus events
• Interaction signals such as clicks, scrolling, app switches, aggregated text input, and clipboard operations including clipboard text

What is stored locally (tiered retention)

The retention scheduler runs hourly with per-layer TTLs that reflect how the intelligence pipeline actually consumes each data type:

The scheduler removes files, clears raw columns and side tables, then deletes expired metadata rows. Intelligence tables are not purged automatically.

Encryption at rest

The SQLite database is encrypted at rest using SQLCipher (AES-256). The key is auto-generated on first launch (32 random bytes), stored at ~/.relevare/.db-key with mode 0600 on Unix, and applied via PRAGMA key. Without it, sqlite3 ~/.relevare/db.sqlite returns file is not a database. Existing unencrypted databases from earlier releases are migrated transparently on upgrade.

Exclusions and limits

• Known password managers and configured app or website blocklists are excluded when detected.
• PII filters try to redact common credentials, payment numbers, tokens, and connection strings before analysis.
• Personal-app classification excludes content from analysis when it is identified as personal.
• These controls reduce exposure but cannot guarantee that sensitive text will never be captured. Administrators should configure blocklists for required exclusions.

Retention configuration

IT administrators can configure retention at deployment time via CLI flag or environment variable. Custom uniform TTLs are also supported by setting individual layer values in the deployment config.

Local API authentication

The HTTP API at 127.0.0.1:3030 requires authentication for all mutation endpoints (POST, PUT, PATCH, DELETE). A 32-byte API key is auto-generated on first launch and stored at ~/.relevare/api-key.txt. Read endpoints (GET) and the /health liveness check are exempt. This prevents cross-process abuse from other local applications, including malicious browser extensions and CSRF from a logged-in tab.

Credential storage

ChatGPT credentials are stored in the operating system's credential manager when supported. Local identity and license files under ~/.relevare/ are restricted to the current operating-system account. Build-time managed AI signing secrets are not embedded in public release binaries.

Solution build handoff

Relevare can prepare a build brief and hand it to a coding agent chosen by the user. The public build flow does not expose a remote tool that silently installs or enables local automations. The coding agent works in its own environment and uses its normal approval controls.

6. Org Dashboard Data Flow

The org dashboard is an optional paid feature. Understanding how it works is important for evaluating the privacy implications for employees.

What rolls up

Only anonymized, aggregated intelligence patterns are transmitted to the org dashboard:

• Bottleneck patterns that appear across multiple employees are surfaced as team-level findings
• Dollar-cost estimates are aggregated across the team
• No individual employee's data is attributed or identified in the org dashboard

What never rolls up

• Raw screen captures
• Individual employee activity timelines
• Application usage by named individual
• Any data that could identify which employee a finding came from

7. Compliance Posture

Current status as of August 2, 2026:

8. Binary Integrity

All Relevare release binaries are:

• macOS: code-signed with an Apple Developer ID certificate, notarized by Apple for Gatekeeper compatibility, and run with hardened runtime enabled
• Windows: code-signed via Azure Trusted Signing (Authenticode) as part of the CI/CD release pipeline
• Auto-updates on both platforms are cryptographically verified using minisign before installation. A tampered update cannot be installed even if an attacker controls the update server
• Distributed only via the official Relevare download page

Do not deploy binaries obtained from any other source. If your MDM or software distribution system requires a verified hash, contact us at [email protected] and we will provide SHA-256 checksums for each release.

9. Managed Deployment

macOS (Jamf / other MDM)

Relevare can be deployed silently via MDM. The signed and notarized .pkg installer accepts the following deployment configuration:

• Pre-populated org JWT token (eliminates per-device activation)
• --retention-days override
• --intelligence-interval-secs override
• --host binding (for LAN-only deployments)

Windows (Intune / SCCM)

MSI installer with equivalent silent deployment parameters. Contact [email protected] for deployment documentation.

10. Incident Response & Contact

For security vulnerability disclosure, we follow a 90-day responsible disclosure policy. Please contact [email protected] before public disclosure. We acknowledge reports within 48 hours and triage within 7 days.