Security
A defence system has to earn trust before it asks for any.
Principles
Everything Vamocles builds, from the command picture to the apps on a phone, follows the same three rules. This page lists no certifications.
The system recommends. People decide. Nothing consequential happens on anyone’s behalf until the person with the authority to act says so.
Each part asks for only what its job needs, only when it needs it, and keeps it no further away than the device in your hand.
Vamocles watches, warns, protects and rescues. It is built to hold the line, never to cross it.
Data flows
This is the complete list of network traffic the Vamocles apps for iPhone and Mac make, read from their code.
| Feature | Goes to | What leaves the device | When |
|---|---|---|---|
| Broker search pagesThe public search pages of the people-search and data-broker sites on the list | First and last name, and any other names you add, in the search address, as any visitor’s search would. Your city and phone number are matched on the device and are not sent. | Only while a sweep runs: when you start one, or at the weekly re-scan if it is on. | |
| The broker’s official channelThrough your own Mail app, or the broker’s opt-out form in your browser | The request you have read, with the details the broker needs to find the listing. Never a government ID. | Only when you tap Send, or submit the form yourself. | |
| LeakIXHave I Been Pwnedcrt.shHave I Been Pwned and crt.sh are asked about domains only | The domain or organisation name you watch. LeakIX also receives your own free API key, in a request header. No email addresses and no passwords. | When you run a check, and at the daily re-check if it is on. | |
| Apple’s speech recognitionOnly as a fallback | Your speech, only when this device cannot recognise it on its own. Recognition runs on the device wherever it is supported. Vamo’s replies are spoken on the device. | Only while voice mode is listening. | |
| Your trusted contactOnly if you have chosen one | A message that Lock Down is on, so someone knows you may be under attack. | Only when you turn on Lock Down. | |
| Nowhere | Nothing. Names, metadata and code signatures are read on the Mac. No file is uploaded. | Never. | |
| Nowhere | Nothing. The conversation makes no network calls. | Never. | |
| Nowhere | Nothing. The system checks Face ID, Touch ID, your passcode or your Mac password and tells the app only whether it succeeded. | Never. | |
| Your browser or mail app | Whatever you choose to open or send, such as the privacy policy, a feedback email or the page for a LeakIX key. | Only when you tap them. |
Reflects the apps for iPhone and Mac, available in preview, as of 23 September 2026. When a flow changes, this table changes with it.
On the device
What the apps hold stays on the device, and the most sensitive of it gets the strongest protection the system offers for it.
Biometric data never reaches the app.
Your Vanish identifiers and your LeakIX key.
Readable only after the device is first unlocked, and bound to it: they never move to another device, even through a backup. Vanish never keeps them in plain settings.
Vanish results and Monitor findings.
On iPhone, written with complete file protection: encrypted on disk and unreadable while the phone is locked.
The Vamo conversation.
Held in memory. It is never written to disk, Vamocles never sends it anywhere, and closing the app clears it. In voice mode, your speech goes to Apple’s recognition servers only when this device cannot recognise it on its own.
Your preferences, such as appearance and App Lock timing, and the name, email and trusted contact you add in Settings.
They stay in the app’s settings on the device. Export My Data and Delete All Data are in Settings, on iPhone and on the Mac.
Responsible disclosure
If you believe you have found a security problem in a Vamocles app or on this website, we want to hear from you, and we will work with you in good faith.
Send your report to
security@vamocles.comSubjectSecurity report
Sensitive details? Send a short first note without them, and we will agree a safer way to receive them.
The page address, or the app, its version and the device and system you used.
The steps, the requests or a short proof of concept, so we can see what you saw.
What an attacker could do with it, and anything that limits the impact.
Where to reply, and whether you would like to be credited when it is fixed.
If you make a real effort to avoid harming people, their privacy and their data, access only what you need to show the problem, and give us a fair chance to fix it before telling anyone else, we will not pursue or support legal action against you for your research. This does not cover anything that harms people or breaks the law in other ways.
We work on the fix with you, agree when details can be published, and credit you by name if you would like to be credited. Please keep the details private until then.
We do not run a paid bug bounty programme today. We thank researchers publicly, when they want to be thanked, and we will say so here if that changes.
A person reads every report and replies from security@vamocles.com, then keeps you informed until the issue is resolved. We do not publish response times we cannot yet show a record for.