Security

Two different things called "security" here

This page covers two layers: the security of your VOLARI account and this website (real, implemented today) and the security architecture of the SYLRA desktop agent itself (still being finalized ahead of launch). It's worth keeping them separate.

Your VOLARI account — implemented today

• Passwords are hashed with PBKDF2-SHA256 before storage. VOLARI never stores, and cannot recover, your plaintext password.
• Sessions are opaque random tokens; only a one-way hash of the token is stored server-side, in an httpOnly cookie your browser's JavaScript can't read.
• Changing your password or resetting it automatically signs out every other active session.
• You can view and individually sign out active sessions, and permanently delete your account, from Settings.
• The admin console is gated by a real authenticated session plus an account role check — not a hidden URL or a client-side flag.

SYLRA (the desktop agent) — still being finalized

SYLRA's direction is local-first design, permission-and-approval-gated actions, and activity logging — see How SYLRA Works and Permissions. The full production security architecture for the agent itself is still being finalized ahead of launch.

What this site won't claim

No page here claims SYLRA or VOLARI is "100% secure," "cannot be hacked," or that "zero data ever leaves your computer." Those are the kind of absolute promises no product can honestly make, and this project would rather be accurate than impressive.