IRIS security
Last updated 13 November 2026
A plain-language account of what leaves your phone and glasses, where it goes, how it is protected, how long it is kept, and how to delete it. The privacy policy remains the authority on what we process and why.
At a glance
- Everything IRIS sends to our servers travels over encrypted connections.
- Speech and conversation text are processed to answer you. We do not keep them unless you turn on a feature that does (session recordings, cloud backup).
- Your voiceprints and the API keys you type in never go into the cloud backup.
- IRIS is not open source. Instead, every release publishes a software bill of materials and a vulnerability report, below.
- Found a problem? Write to [email protected].
What leaves your phone and glasses
Most of what IRIS creates stays on your phone. Data leaves it only when a feature needs a server.
| What | Where it goes | Do we keep it? |
|---|---|---|
| Speech, while IRIS is listening | Your phone to our server over a secure connection, which passes it to the speech and AI service providers that handle the request. Your phone holds no provider keys. | No, unless you turn on session recordings (Pro, off by default). |
| Transcript text and the context IRIS needs to answer (your modes, memories, documents) | The same path. | Not kept by us, except what the privacy policy lists, such as the 48-hour Ask log and session review on Pro. |
| Your own provider keys, if you enter them | Your phone talks straight to that provider. Nothing passes through us. | We never see the request. |
| Cloud backup (Pro, on by default) | Your phone to our server: sessions, memories, modes, to-dos, settings. | Until you turn backup off. It expires 2 years after the last backup. |
| Account and billing | Email address, licence key, plan and status. Payment is taken at our payment processor’s hosted checkout. | While you are a customer, then as long as tax and accounting law requires. |
| Diagnostics | Event names, counts and timings. Never what was said, the text of a cue, or your email address. One switch in Settings turns them off. | About a month; totals longer. |
Voiceprints are made, matched and stored on your phone only. They are not included in the backup.
In transit
- IRIS connects only to encrypted addresses (HTTPS and secure WebSockets). The one exception is an address you type yourself for a device on your own network, such as a home server.
- IRIS on the web signs you in with a one-time link sent to your email. The link works once and expires after an hour. The browser cookie it sets is secure, HttpOnly and SameSite=Strict, and the site refuses requests that do not come from itself.
- Payment notifications are checked with the payment processor before we act on them. One that fails the check is ignored.
At rest
- Server-side data sits in our cloud hosting provider’s managed storage, which encrypts stored data.
- The connection details you give us for home automation and for your own agent are encrypted a second time by us, with a key kept apart from the data.
- IRIS on the web sign-in links and tokens are stored only as one-way hashes.
- On your phone, IRIS keeps its data in the app’s own storage.
How long it is kept
The full table is in the privacy policy. In short:
- Audio: not kept by us. Session recordings, if you turn them on, stay until you delete them.
- Ask and Hey Even questions and answers (Pro): up to 48 hours.
- Cloud backup: until you turn it off, expiring 2 years after the last backup.
- IRIS on the web sign-in: 30 days after your last visit.
- Audience Q&A: deleted 12 hours after the event’s last activity.
Deleting your data
- Cloud backup. Turn it off in Settings → About & help → Privacy & legal. That deletes the stored copy and the copy made for IRIS on the web, and signs out every browser.
- On your phone. Delete sessions, memories, recordings and voiceprints in the app.
- Everything else. Email [email protected]. We may ask you to confirm it is you, then we erase the records tied to your licence. We keep only what the law or billing requires, such as payment and tax records, and anything held by the payment processor is theirs.
Software bill of materials
We are not open-sourcing IRIS. To show you what you are running, every release of IRIS, and each server it talks to, publishes a software bill of materials (CycloneDX, machine-readable), generated from the exact build, together with a vulnerability report listing every known advisory against those components and its status.
Read the bills of materials and vulnerability reports on sufiplugins.com
Reporting a security problem
Email [email protected] with “Security” in the subject, and say what you found and how to reproduce it. Please report it to us privately first, avoid touching other people’s data, and give us a reasonable time to fix it before you publish. Our contact details are also at /.well-known/security.txt.
Sufi Plugins, LLC, Maryland, USA · [email protected] · Privacy · Terms · IRIS