Security
Last updated: June 19, 2026
Premise AI is built so that sensitive inputs stay on the user's device. This page describes how the service is designed and how a suspected issue can be reported. VinceLabs is based in Ottawa, Ontario, Canada.
1. Architecture
The service is a single static web page with no application backend and no database holding user content. The analysis runs in the browser and calls the chosen AI provider's API directly. There is no server in the middle that receives a user's idea or report.
2. API keys
A user's AI provider API key is held in the browser's local storage, on the user's own device. It is never transmitted to VinceLabs. It is sent only to the chosen provider, over HTTPS, to run a requested analysis. Removing the key in settings deletes it from the browser.
3. Data in transit
Connections to the site and to the AI provider's API are made over TLS (HTTPS). The idea text and prompt travel directly from the browser to the chosen provider when an analysis is run.
4. Data at rest
Idea text, generated reports, the selected model, and the theme preference are stored locally in the browser. None of this is written to a VinceLabs server. A user controls retention by removing the key in settings or by clearing browser storage.
5. No accounts
The service has no login, no password, and no user database. There is no server-side store of credentials or personal data that could be compromised.
6. Third-party processing
When an analysis runs, the idea and prompt are processed by the chosen AI provider (Anthropic, OpenAI, Azure OpenAI, or a custom endpoint) under that provider's own security and privacy terms. The user is responsible for the provider key and for usage under the user's own provider account.
7. Shared and managed devices
Because the key and reports are stored in the browser, the key should be removed in settings after use on a shared or public device, and browser storage cleared. On a managed device, organization policy for browser data applies.
8. Responsible disclosure
Reports of a suspected vulnerability are welcome. They can be sent to sales@vincelabs.com with enough detail to reproduce the issue. Please avoid accessing or altering data that is not the reporter's own, and allow reasonable time to address the report before any public disclosure.
9. Limitations
No method of storage or transmission is completely secure, and absolute security cannot be guaranteed. The service depends on the security of the user's own browser, device, and AI provider account. This page describes current design and is not a warranty.