Security

The shape of the product

Owlka is a desktop app for Mac and Windows plus an iPhone app. The desktop app does the real work; the iPhone app is the front seat. The two talk to each other through an encrypted relay that we operate but cannot read.

Your code stays on your desktop

The Owlka desktop app launches the Claude tools under your own Anthropic subscription. Your files, your terminal, and your project memory all live on your desktop. We never copy them to a server.

Your conversation is end-to-end between phone and desktop

Every message and every reply is sealed on your phone or your desktop before it leaves the device. Only your paired devices hold the keys. The relay just shuttles sealed packets back and forth.

Pairing happens face to face

The first time you pair a phone with your desktop, you scan a one-time QR code from the desktop app. That exchange is what hands the keys over. Nothing in the keys ever crosses our servers in the clear.

We hold no master key

If you lose your desktop and all your paired phones, we cannot recover your conversation history. There is no Owlka-side decryption key by design.

End-to-end encryption, in detail

Owlka uses well-known, open, public-key authenticated encryption primitives. The exact algorithms are listed below.

Library

Apple's CryptoKit on iPhone, and the audited x25519-dalek, chacha20poly1305, and hkdf Rust crates on the desktop. Both sides implement the same authenticated public-key sealed-box scheme, byte for byte, for every sealed packet.

Key exchange

Curve25519 elliptic-curve Diffie-Hellman. Each paired device pair derives a shared secret without that secret ever travelling over the wire.

Bulk encryption

ChaCha20-Poly1305 authenticated encryption with a fresh 96-bit random nonce per packet. Nonces are never reused for a given key.

Integrity

Poly1305 message authentication code. A tampered packet is rejected on the receiving device; the relay has no way to forge a packet that would be accepted.

Per-pair keypairs

Every phone-and-desktop pair generates its own keypair. Tim's phone paired with his home Mac has a different keypair from Tim's phone paired with his work laptop, and a different keypair again from his wife's phone paired with the same home Mac. Revoking one pair does not affect any other pair.

The content-blind relay, in plain English

The relay is the piece of Owlka infrastructure your devices talk to while you work. Here is exactly what it does and does not do.

What it sees

Sealed packets, the IP addresses of the connecting phone and desktop, and the timing of each packet. It cannot open the packets.

What it does

Queues sealed packets so a phone that drops off Wi-Fi can pick up where it left off when it comes back. Typical queue depth is minutes.

What it does not do

It does not store conversation history. It does not log packet contents. It does not have a key that would let it.

Where it runs

On a small server we operate, reachable only through a Cloudflare tunnel. Cloudflare terminates TLS at relay.owlka.com and forwards the sealed traffic to the relay, so the connection from your device is protected by Cloudflare's certificate and the origin is not exposed directly. The server stores no decryption key.

The one other Owlka server

The relay is not quite the only Owlka machine your desktop contacts. It also asks our download host, download.owlka.com, whether a newer version exists, once at startup and every six hours after that, and fetches the terminal software it needs there on first run. Those are plain file downloads. Nothing about your work is sent to make them.

The microphone, and where your voice goes

Owlka does not transcribe speech on your device. If you use Owlka's microphone button, your audio is sent to ElevenLabs, a third-party speech company, and transcribed there. That only happens if you have added your own ElevenLabs key, and the button does nothing until you do.

Nothing happens without a key you add yourself

Owlka ships no ElevenLabs key and does not provide one. Until you paste your own ElevenLabs API key into Connectors on the desktop app, the microphone button stays greyed out, no recording is made, and your microphone is never opened. Delete the key and the feature switches off again.

Where your audio actually travels

From the iPhone app, the recording is sealed with your pair's keypair, sent to your own desktop, and your desktop passes it to ElevenLabs using your key. From the desktop app, the recording goes straight from your machine to ElevenLabs. Either way the request is billed to your own ElevenLabs account and governed by ElevenLabs' terms, not ours.

The spoken reply goes there too

When Owlka reads a reply back to you out loud, the text of that reply is sent to ElevenLabs to be turned into speech. So it is not only your voice that reaches ElevenLabs; the text being read aloud does as well.

We never receive the recording

Our relay carries the audio from your phone to your desktop as sealed bytes it cannot open, and the desktop app then talks to ElevenLabs directly. No recording and no transcript ever arrives on an Owlka server.

There is no on-device transcription

Until August 2026 this page said Owlka transcribed your speech on your phone using Apple's Speech framework. That was wrong, and we have corrected it rather than leave it standing. Owlka does not transcribe on the device on any platform. If you want dictation that does not involve ElevenLabs, use your keyboard's own microphone key rather than Owlka's. That one is Apple's feature under Apple's terms, and we make no claim about where it sends your audio.

Permission

Your device prompts you the first time Owlka opens the microphone. You can revoke microphone access at any time in your system settings, and you can disconnect ElevenLabs at any time in Connectors on the desktop app.

The desktop download

Owlka ships a Mac app and a Windows app. Both are code-signed before they ever reach you, and your computer checks the signature before it will run the build.

Mac code signing

The .dmg you download is signed with our Apple Developer certificate and notarised by Apple. macOS Gatekeeper checks both before opening it.

Windows code signing

The .exe you download is code-signed in the name of Owlka Ltd and timestamped, so Windows does not show an unknown-publisher warning.

Auto-update (Mac)

Mac updates are downloaded over HTTPS and their signature is checked before the new build replaces the old one. The signature checked at that moment is ours, not Apple's: every release is signed with an Owlka release key that is kept outside the app, and an update that does not verify against it is refused. Apple's own signature and notarisation ticket travel inside the app bundle, so what ends up installed is still the notarised build Apple approved.

Auto-update (Windows)

The Windows build updates itself, like the Mac build. It checks our signed update feed over HTTPS, and the signature on a new build is verified before it replaces the old one. An update with a broken or missing signature is refused. One exception: installs from version 0.1.59 or earlier predate the updater and never check the feed, so those need one manual re-download from the download page, after which they update themselves like any other.

What runs locally

The Owlka desktop app, which keeps the encrypted channel to the relay open itself rather than through a separate helper. The Claude tools, under your own Anthropic subscription. A small approval hook that Claude runs before any gated action, so the decision you make is enforced on your own machine. Terminal multiplexer software that hosts your sessions. A Python interpreter, and up to three small Python helpers that give Claude Owlka's memory and connector features. All of it runs on your computer under your own user account.

The iPhone app

Keys in the Keychain

The keys that pair your phone to a desktop live in the iOS Keychain, protected by the device passcode and Face ID or Touch ID.

Cached messages

The phone caches the messages you have already seen so the UI feels fast. The cache is encrypted at rest by iOS Data Protection.

Removing a phone

Unpairing a phone from the desktop app invalidates that phone's key. After that, sealed packets from the unpaired phone are refused.

Honest disclosures

We would rather lose a sale than mislead you. The items below are limits of the product and the company as they stand today.

We see metadata, and we see approval notifications

We can see that your phone and your desktop talked, when they talked, and how much data they exchanged. We cannot see what they said: your messages are sealed on the device and the relay has no way to open them. There is one real exception, and it is worth stating clearly. When Owlka holds an action for your approval and pushes a notification to your phone, the text of that notification crosses our relay unsealed, because a push notification has to be readable to be delivered. That text is the short headline describing what Claude wants to do, the reason it was held for you, and, when no headline was written, the command itself. Your conversation is not in it, but it is not nothing. If hiding even that matters to you, an internet-based assistant is the wrong shape.

What you send to Claude goes to Anthropic, not to us

Owlka is not in this path at all. Claude is Anthropic's software: the Owlka desktop app launches it on your own machine, under your own Anthropic account, and it connects to Anthropic directly. So everything you send to Claude reaches Anthropic, and Anthropic's privacy terms govern that traffic rather than ours. Anthropic is not an Owlka sub-processor, because none of your Claude traffic ever passes through us. Owlka has no partnership with Anthropic.

No SOC 2 or ISO 27001 in Owlka's own name yet

We do not yet hold SOC 2 or ISO 27001 in Owlka's own name. The relay runs on Cloudflare's network (SOC 2 Type II, ISO 27001) and the App Store distribution is Apple's. We will publish our own certification roadmap when we have one.

No model training on your work

Owlka does not train any model. Your code, your prompts, and the work Claude produces for you are not used to train anything by us. Your usage of Claude is governed by your agreement with Anthropic.

Reporting a vulnerability

Contact

If you find a security issue, please email support@owlka.com with details and put "security" in the subject line. It reaches the same small team; we would rather publish an address that works than one that looks the part and bounces.

Response time

We respond to verified reports within seven days.

Credit

We credit researchers publicly with permission.