Most security pages describe policies. This one describes an architecture: your data can't leak from a server we don't have. Here's exactly how the pieces are built.
All records live in a single SQLite database in your user directory. No proprietary container, no hidden sync — you can open, copy, and back it up with standard tools.
API keys and mail credentials are encrypted field-by-field with AES-256-GCM. The key lives in a local keyfile — readable only by your OS user account.
Add a passphrase and the encryption key is derived with scrypt — the app refuses to serve data until unlocked, enforced server-side inside the app, not just hidden in the UI.
Desktop builds are code-signed and notarized, so the OS verifies the app you run is the app we shipped. External links open in your browser, never inside the app shell.
A room is a snapshot of exactly the content you chose — never a live tunnel into your CRM. Password protection is enforced at the transport layer, links are unguessable tokens, and unpublishing takes the content down while preserving the link for a future republish.
Your Gmail or Microsoft 365 credentials are stored encrypted on your machine and used to talk directly to your provider. youdou is never in the delivery path and never sees mail server-side.
Each request carries only the context for that request and goes to the provider you configured — your key, encrypted at rest, or managed routing on paid plans. Nothing is retained by youdou.
The room/sharing transport runs on deny-by-default rules: no public listing of anything, per-record access only, writes gated through an authenticated function. License records are readable per-install only — enumeration is off.
Cross-instance sharing seals payloads end-to-end and pins peer keys on first use (TOFU), so a compromised transport still can't read or forge what teammates exchange — defense in depth behind the rules, not instead of them.
youdou records each AI request — the provider, the model, the host, and whether a single byte left your machine. Choose a local model and the ledger shows exactly that: nothing left.
A local model does drafting, briefs, and extraction entirely on your computer — no key, no cloud, no request to log. Or point youdou at a private endpoint you host.
Mail sync brings in only the threads tied to accounts already in your CRM — not your whole mailbox. The less that is pulled, the less there is to protect.
Credentials are encrypted with a key in a local keyfile. Back it up and you keep access; lose it and no one — not even us — can decrypt on your behalf. That is the point, not a bug.
For HIPAA environments this architecture means PHI never touches a youdou server — your patients' data is secured with you, on your machine, exposed to you and only you. Your obligations (device encryption, access control, backups) stay yours; the vendor-risk column gets very short when the vendor never sees the data. The full local-first case →