Notes from a client call are the most sensitive thing you will write in ShadowOS. This is the whole path they take.
1
Call: Hamburg entity structure
You save a note
Call notes, a contact, a timeline entry. Everything you write starts and ends inside the app on your computer.
2
q7Zk1v+Xw0mB…e3Hs9fQ=
It is encrypted before it touches the disk
The app encrypts your data with AES-256-GCM and a fresh random nonce on every write, then stores it as a single file.
3
System keychain
The key stays in your keychain
The key is generated on first launch and held by your operating system, never next to the data. We never see it.
4
127.0.0.1
AI reads it without leaving
Summaries and nudges come from a language model running on your own machine. Your notes are never sent to an AI provider.
Sent to ShadowOS servers at any step: nothing.
Encryption
AES-256-GCM, authenticated, with a new random nonce on every write
Key storage
macOS Keychain, Windows Credential Manager or Linux Secret Service
AI model
Gemma 3 (4B), run by a runtime bundled with the app and reachable only on 127.0.0.1
Network use
One download of the AI model, about 2.5 GB, and only if you turn AI on
Telemetry
None
Call transcription
Runs on your machine. The audio stays there
How it works
Six things that make ShadowOS different from every other CRM.
Zero network egress
ShadowOS makes no outbound connections during normal use. No telemetry, no analytics pings, no silent sync. The one download is yours to choose: the AI model, once, during setup. After that it runs with your firewall blocking everything.
Encrypted on your disk
Your data is one file on your own disk, encrypted with AES-256-GCM. The key is kept in your operating system's keychain, apart from the file, so a copied folder or a stolen backup is unreadable on its own.
Opt-in encrypted backup
When you choose to enable cloud backup, your database is encrypted with AES-256 on your device before any byte leaves it. We hold no keys. Even a full breach of our servers yields nothing readable.
Open audit surface
The local sync and encryption layers are open-source. Read the code. Run it in a sandbox. We want you to verify our claims, not just believe them.
GDPR compliant by design
When data never leaves your machine, there's no data processor relationship to worry about. No DPA required, no Schrems II exposure, no consent banners for your own CRM.
No account, no exposure
Creating an account means handing over an email address, creating a target. ShadowOS works fully without one. There's no user database of yours for us to lose.
“The most private CRM is the one that has nothing to give away — because it holds nothing on our end.”