How Virlow protects your notes
Virlow, operated by Bata Labs LLC, encrypts private notes and files on your device before syncing. This page explains that protection and the different privacy boundaries of metadata, publishing, AI connections and code execution.
Encryption
Your notes, titles, files, and documents are encrypted with AES-256-GCM on your device before anything is sent to our servers. The encryption key is derived from your master password using PBKDF2-SHA-256 with 250,000 iterations and a per-user salt. That derivation happens locally, in your browser.
Every encrypted item uses a fresh, random initialization vector, so the same content never produces the same ciphertext twice. Titles and content are encrypted independently.
Zero-knowledge, in practice
For ordinary browser vault unlocking, your master password stays on your device. We cannot reset it or recover your encrypted content if you lose it. The optional hosted AI connector has a different unlock flow, described below. When you unlock Virlow, your browser derives the key and checks it against a verifier: a known value encrypted under your key. If the check passes, your device can decrypt your notes. Ordinary browser vault unlocking does not send the master password or the derived key to the server.
The web app keeps a non-extractable encryption key in memory and, where browser storage is available, in IndexedDB so an eligible session can survive a reload. Restoration requires a matching browsing-session marker and an unexpired record. The app uses a four-hour inactivity timeout and clears keys when you lock or sign out. Do not rely on closing a tab as immediate secure erasure.
What the server can and cannot see
Private content: ordinary encrypted syncing does not give the server readable note titles, note bodies or file contents. Publishing, hosted AI sessions and code execution deliberately make selected content readable outside your device, as described below.
The server does hold, in order to run the service: your email address, a securely hashed login password, encrypted note and file data, and operational metadata such as timestamps, item counts, ciphertext sizes, and file MIME types. Folder names and note tags are stored in readable form so the app can organize your workspace. Notes you explicitly choose to publish are stored in readable form by design, because publishing is a deliberate opt-out of encryption.
Accounts and authentication
Login passwords are hashed with bcrypt and never stored in the clear. Sessions use short-lived signed tokens plus rotating refresh tokens, with reuse detection that revokes a session family if a stolen token is replayed. Optional two-factor authentication (TOTP) adds a second step, with its secret encrypted at rest. Traffic is served over HTTPS with strict transport security.
Optional AI connectors
Virlow offers an optional hosted AI connector, so an AI assistant can reach your notes without you running anything on your own machine. It is off by default on every account and has to be switched on in Settings. Enabling it and unlocking a session changes who can decrypt your private content.
With it on, and only while you have unlocked a hosted session, the guarantee changes: you send your master password to our server, our server derives the key, and it can decrypt and read your notes for the life of that session. There is no way to run a hosted connector without this, which is why it is a switch rather than a default.
The hosted unlock screen defaults to 30 minutes of inactivity and offers longer idle windows, up to 72 hours. Connector activity restarts the idle clock. You can request that the session lock sooner using Lock now. Connecting an AI client is separate from unlocking; approval alone does not unlock the session.
While a hosted session is unlocked, server-side access to the key is part of the trust model. The local connector instead runs on your machine and does not send your master password to Virlow's API. In either mode, a connected assistant receives readable content through the tools you let it use; its provider's data policies apply.
Publishing and code execution
Publishing a note makes its title and content readable by anyone with its link. Running code sends the selected code to Virlow's API for remote code execution in a sandbox service. That submission is not end-to-end encrypted against the executor. Avoid running code containing secrets.
The honest limits
Virlow runs in your browser, and a browser app is delivered by a server every time it loads. For private note bodies, titles and files synced through the ordinary encrypted flow, a passive storage server holds ciphertext rather than readable content. This protection does not cover the metadata and optional features described above. It cannot, by the nature of web applications, fully protect you against a server that is actively compromised and ships modified code designed to capture your password as you type it. This limit is true of every browser-based end-to-end encrypted product, not just Virlow. We state it plainly so you can make an informed choice.
There is also no backdoor and no recovery path. If you forget your master password, your encrypted notes cannot be recovered by anyone, including us. Keep it somewhere safe.
Reporting a vulnerability
If you believe you have found a security issue, please email team@batalabs.com with details and steps to reproduce. Please give us a reasonable window to investigate and fix the issue before any public disclosure. We appreciate responsible reporting.