How Virlow protects your notes
Virlow, operated by Bata Labs LLC, encrypts private notes and files on your device before syncing. This page explains that protection and the different privacy boundaries of metadata, AI connections and code execution.
Encryption
Your notes, titles, files, and documents are encrypted with AES-256-GCM on your device before anything is sent to our servers. The encryption key is derived from your master password using PBKDF2-SHA-256 with 250,000 iterations and a per-user salt. That derivation happens locally, in your browser.
Every encrypted item uses a fresh, random initialization vector, so the same content never produces the same ciphertext twice. Titles and content are encrypted independently.
Zero-knowledge, in practice
For ordinary browser vault unlocking, your master password stays on your device. We cannot reset it or recover your encrypted content if you lose it. The optional hosted AI connector has a different unlock flow, described below. When you unlock Virlow, your browser derives the key and checks it against a verifier: a known value encrypted under your key. If the check passes, your device can decrypt your notes. Ordinary browser vault unlocking does not send the master password or the derived key to the server.
The web app keeps a non-extractable encryption key in memory and, where browser storage is available, in IndexedDB so an eligible session can survive a reload. Restoration requires a matching browsing-session marker and an unexpired record. The app uses a four-hour inactivity timeout and clears keys when you lock or sign out. Do not rely on closing a tab as immediate secure erasure.
What the server can and cannot see
Private content: ordinary encrypted syncing does not give the server readable note titles, note bodies or file contents. Hosted AI sessions and code execution deliberately make selected content readable outside your device, as described below.
The server does hold, in order to run the service: your email address, a securely hashed login password, encrypted note and file data, and operational metadata such as timestamps, item counts, ciphertext sizes, and file MIME types. Workspace names and note tags are stored in readable form so the app can organize your workspace.
Accounts and authentication
Login passwords are hashed with bcrypt and never stored in the clear. Sessions use short-lived signed tokens plus rotating refresh tokens, with reuse detection that revokes a session family if a stolen token is replayed. Optional two-factor authentication (TOTP) adds a second step, with its secret encrypted at rest. Traffic is served over HTTPS with strict transport security.
A forgotten login password can be reset from the sign-in page: we email a single-use link that expires after 30 minutes, and using it signs out every other session. That resets the password you sign in with, not your master password. Your notes open again only if you still know the master password, and the email says so before you click.
Optional AI connectors
Virlow offers an optional hosted AI connector, so an AI assistant can reach your notes without you running anything on your own machine. It is off by default on every account and has to be switched on in Settings. Enabling it and unlocking a session changes who can decrypt your private content.
With it on, and only while you have unlocked a hosted session, the guarantee changes: you send your master password to our server, our server derives the key, and it can decrypt and read your notes for the life of that session. There is no way to run a hosted connector without this, which is why it is a switch rather than a default.
The hosted unlock screen defaults to 30 minutes of inactivity and offers longer idle windows, up to 5 days. Connector activity restarts the idle clock. You can also choose to never lock automatically, after confirming you understand the risk; your key then stays in our server's memory until you lock it or the server restarts. You can request that the session lock sooner using Lock now. Connecting an AI client is separate from unlocking; approval alone does not unlock the session.
While a hosted session is unlocked, server-side access to the key is part of the trust model. The local connector instead runs on your machine and does not send your master password to Virlow's API. In either mode, a connected assistant receives readable content through the tools you let it use; its provider's data policies apply.
The built-in assistant
The assistant inside Virlow is optional and part of Pro. It runs in your browser, where your notes are already decrypted, and sends a conversation to Anthropic through Virlow's API to be answered. What is sent is what you ask, the notes it reads to answer, text you have selected, files you attach, and, when you switch web search on, the searches it runs. That content is readable by Anthropic, and passes through Virlow's server in transit without being stored there in readable form; Anthropic's data policies apply to it. Notes the assistant does not read are not sent.
Conversations, and the instructions and prompts you save for the assistant, are encrypted in your browser with your master key before they are stored, like notes. Files you attach are not stored. Dictation uses your browser's own speech recognition, which in some browsers sends the audio to the browser's maker.
Code execution
Running code sends the selected code to Virlow's API for remote code execution in a sandbox service. That submission is not end-to-end encrypted against the executor. Avoid running code containing secrets.
The honest limits
Virlow runs in your browser, and a browser app is delivered by a server every time it loads. For private note bodies, titles and files synced through the ordinary encrypted flow, a passive storage server holds ciphertext rather than readable content. This protection does not cover the metadata and optional features described above. It cannot, by the nature of web applications, fully protect you against a server that is actively compromised and ships modified code designed to capture your password as you type it. This limit is true of every browser-based end-to-end encrypted product, not just Virlow. We state it plainly so you can make an informed choice.
There is also no backdoor and no recovery path. If you forget your master password, your encrypted notes cannot be recovered by anyone, including us. Keep it somewhere safe.
Reporting a vulnerability
If you believe you have found a security issue, please email team@virlow.com with details and steps to reproduce. Please give us a reasonable window to investigate and fix the issue before any public disclosure. We appreciate responsible reporting.