Sohamlab

Trust and security

How Sohamlab keeps your data safe

Your life data stays on your computer, encrypted. The cloud only knows who you are and what plan you have.

Last updated: 10 November 2026

1. Your data stays on your computer

Sohamlab is a desktop app for Mac and Windows. Your records, journal, chart, documents and Shania’s history are stored on your own computer and never on our servers. We cannot read them, so there is nothing of yours for us to lose in a breach.

Encrypted at rest

The app’s database is encrypted (SQLCipher) with a 256-bit key created on your computer, and the documents you add are encrypted too. You choose how the key is protected:

  • Kept by the app (the default), so you never see a prompt;
  • your operating system’s keychain; or
  • a passphrase you type when the app starts. This is the strongest option, and if you forget it, no one can recover your data, including us.

Encrypted backups

A backup is one file locked with a passphrase you choose, separate from the database key (Argon2id, then AES-256-GCM). You decide where it is kept. It can restore your data on a new computer.

Locked to the app

The app runs a small local server that only listens on your own computer, and it refuses any request that does not carry the app’s own launch token, so other programs on your computer cannot use it.

Deleting

When you delete something in the app, it is removed from the database on your computer. To remove everything, uninstall the app and delete its data folder, and any backups you made.

2. AI with guardrails

  • You choose where AI runs: a model on your own computer, Apple Intelligence, your own API key with Gemini, Claude or OpenAI, or Sohamlab AI with Soham Pro.
  • Identifiers stay home. Before anything goes to a cloud model, a filter on your computer replaces names, numbers and other identifiers with placeholders, puts them back in the reply, and refuses to send what it cannot make safe. Sohamlab AI checks again and rejects a request that still holds an obvious identifier.
  • Sensitive work stays local. Your documents, journal and anything about your health only ever go to a model on your own computer. If none is set up, that work does not run.
  • You can see what was sent. Every request that left your computer is recorded in the app under What Shania sent, with where it went.
  • Nothing kept by us. Sohamlab AI passes your request to the model and discards it. We keep only a count of usage for your allowance. Nothing is used to train any model.
  • Keys in the keychain. Your own API keys are kept in your operating system’s keychain, not in files.
  • Qualified people for serious questions. Shania points you to qualified professionals for medical, psychiatric, legal and significant financial questions.

3. Sign-in without passwords

Sohamlab has no passwords, anywhere. You sign in with a one-time code sent to your email, and, if you switch on two-step sign-in, a 6-digit code from an authenticator app.

  • No passwords to steal. There are no password hashes in our database, so there is nothing to extract, nothing to reuse from leaks elsewhere, and nothing for a fake sign-in page to harvest. Password sign-in is refused even if someone tries it.
  • Codes work once and run out. An email code expires after 10 minutes and can be used once.
  • Two-step sign-in. With an authenticator app switched on, an email code alone is not enough, including for tokens issued before you switched it on.
  • Hashes only. Sign-in codes and device tokens are stored only as SHA-256 hashes.
  • Limits on guessing. Sign-in attempts are rate-limited by address and by email.
  • Signed licences. Your plan is a licence signed with Ed25519 that the app checks on your computer, so it works offline for up to 30 days and cannot be forged.
  • Sign out a device. Signing out in the app revokes that computer’s token on our side.

4. What the cloud holds

Only your account: email address, plan and licence, devices you have signed in on, payment records (no card numbers) and AI usage counts. It is held by Supabase in the EU (Frankfurt), with the website and sign-in endpoints on Cloudflare, sign-in emails sent by Brevo and payments handled by Dodo Payments. Every connection uses HTTPS (TLS). Payment card details go straight to Dodo’s checkout and never reach us. Full details are in the privacy notice.

5. Who can see what

  • Your life data: only you, on your computer. We have no copy and no key.
  • Your account data: a small, named group at SuperStudies, only to run the service, answer a support request you have raised, or where the law compels us.
  • We never sell, share or pass your data to advertisers or anyone else.

6. What we do not collect

  • No behavioural tracking: no analytics, mouse movements, clicks, scroll depth or session length.
  • No tracking cookies or advertising scripts, on the site or in the app.
  • No precise location. We use your approximate country only to suggest a currency at checkout.
  • No device fingerprinting.
  • No more logs than security and support need.

7. Your rights

You can ask for a copy of your account data, correct it, or close your account and delete it. Your rights under the UK GDPR, the EU GDPR, India’s DPDP Act and US state laws are set out in the privacy notice.

8. Report a security problem

If you find a vulnerability, please tell us at admin@superstudies.co.uk (see our security.txt). Please give us a reasonable time to fix it before you share it with anyone else, and do not access other people’s data or disrupt the service while testing. Questions about your data or our security practices are welcome at the same address.