Security
How ARAMO handles your data
What runs locally, every connection the app makes, and how licences, payments and downloads are protected.
The model in one sentence
Analysis (speech, faces, motion, audio, scenes), transcription, editing and rendering all run locally. There is no upload step because there is nowhere to upload to.
Every network connection ARAMO makes
| Destination | When | What is sent |
|---|---|---|
| ARAMO's licence service | When you sign in, and at licence check-ins | Your email, your password at sign-in (over HTTPS), a device identifier, the computer's name and the app version. Never media. |
| The site behind a link you paste | Only when you import from a link | A normal download request for that video. |
| YouTube, TikTok, Instagram | Only if you connect an account and switch publishing on | Sign-in through the platform's own page, then the finished clip with its title and description. |
| aramoai.com/oauth/callback | During an Instagram or Facebook sign-in | A single-use sign-in code, passed straight back to ARAMO on your own computer (127.0.0.1). |
| Anything else | Never | ARAMO sends no telemetry and no usage analytics. Cloud rendering is not used. |
After the first sign-in ARAMO keeps working offline for up to 365 days between licence check-ins. Everything else in the app works without a connection.
Licence and credentials
- Signed entitlements. The licence on your machine is signed by our server with Ed25519 and bound to your device, so it cannot be edited or copied to another computer.
- Passwords are stored on our server only as salted scrypt hashes.
- Platform sign-ins for YouTube, TikTok and Instagram are stored in Windows Credential Manager on your computer, never on our servers.
- Administrator access to the licence server requires two-factor authentication.
Payments and downloads
- Cards are entered on PayTabs' hosted page; ARAMO never sees card details.
- A payment only counts when PayTabs' signed notification is verified and the payment is independently confirmed with PayTabs and the amount matches the plan. The browser can never mark an order paid.
- Download links are signed, expire after 14 days, and stop working if the order is refunded.
- The price is always decided by the server from the plan — nothing sent from a browser can change what is charged.
This website
- A strict Content Security Policy limits which scripts and connections the page may use.
- The demo video does not load until you press play, and then uses youtube-nocookie.com.
- The site assistant is not a language model: every answer is written in advance, and your questions are not sent anywhere.
Support without your data
When something goes wrong, ARAMO can create a diagnostic bundle from Settings → System & logs → Create diagnostic bundle. It contains redacted logs and system details, and never includes footage, music or account tokens. You decide whether to send it.
Reporting a security issue
Email info@aramoai.com with “Security” in the subject. Please give us a chance to fix an issue before sharing it publicly.