Security

Last updated: 24 August 2026

The architecture is the security story

Most products promise to protect your data after collecting it. PontX is built so there is nothing to protect on our side: your documents, your search index, and your chat history live on your computer. We operate no cloud that stores or reads them — a breach of our servers cannot expose your files, because your files were never there.

What never leaves your machine

• Your documents and their contents
• The search index built from them
• Your search queries and chat history

The application makes outbound connections only for things you enable: an AI provider you connect (or a local AI — then nothing leaves at all), optional model downloads, and subscription license checks once subscriptions launch. License checks carry license identifiers — never document content.

Read-only by design

The MCP connection that AI assistants use to reach your index is read-only: it exposes no tools that can write, modify, or delete anything. An AI can search and read what you point it at — it cannot change your files.

Encrypted at rest

At launch, the search index and chat history are encrypted on disk. The key is derived from your license and your application password — a password we never see and cannot recover. By design, we do not hold the key: losing the application password means re-indexing from your original files, not asking us for a backdoor, because there is none.

PontX Anywhere

Remote access runs through an encrypted tunnel that terminates on your machine — the TLS certificate’s private key never leaves your computer. Our relay forwards encrypted traffic and can see only routing metadata, not content. Honest boundary: when you connect a cloud AI assistant remotely, that provider necessarily reads the answers you request — same as on your desk.

No tracking

The application sends no telemetry. Crash reporting, when it arrives, will be strictly opt-in and off by default. This website runs no analytics and no advertising trackers.

Reporting a vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability, write to [email protected] with enough detail to reproduce the issue. We will acknowledge your report, keep you informed, and credit you if you wish. Please give us reasonable time to fix an issue before public disclosure, and do not access data that is not yours.

Verify it yourself

Security claims should be checkable. PontX is built so you can watch what it does: point a network monitor at the application and see for yourself that your documents do not leave. A detailed verification guide and a technical security whitepaper are being prepared for launch.