security
Found a problem? Tell us, and we'll thank you
Last updated October 21, 2026 · The Okay Company LLC
How we protect you
- Passkeys instead of passwords, through OkayLogin.
- HTTPS everywhere, with strict security headers on our sites.
- Data encrypted at rest by our hosting provider, and access limited to the people who need it.
- Bring-your-own AI keys stay on your device and go straight to the provider.
- Signed, verified automatic updates for our Mac apps.
Report a vulnerability
If you think you've found a security problem in any of our Services, email okay@okaycompany.com (subject “Security”) with what you found, how to reproduce it, and its impact. We'll acknowledge it within 3 business days, keep you updated, and tell you when it's fixed. We're happy to credit you if you'd like.
Safe harbor
We won't take legal action against good-faith research that follows these rules:
- test only against your own accounts and data, and stop as soon as you reach anyone else's;
- don't degrade the Services: no denial-of-service, spam or social engineering of our people or users;
- don't access, change or keep more data than you need to show the problem;
- give us reasonable time to fix it before telling anyone else.
Our machine-readable contact is at /.well-known/security.txt.