Local provider authentication
Claude Code and Codex credentials stay with their locally authenticated tools. Pair Companion does not operate a shared AI API key.
Security
Designed to keep the trust boundary small.
The desktop app owns the sensitive context. The licensing backend receives only what it needs to validate access.
Pseudonymous device binding
A random device seed is hashed before licensing requests, and the backend uses that hash to enforce one active computer. The free trial additionally sends salted SHA-256 hashes of hardware identifiers so the 30 minutes cannot be reset by reinstalling.
Short-lived visual context
Screenshots created for analysis are deleted after completion. The desktop app does not upload them to the licensing service.
What reaches the licensing service
License key hash, pseudonymous device identifier, platform, app version, plan, subscription status, and validation timestamps. For the free trial: salted SHA-256 hashes of hardware identifiers (on macOS the platform UUID and serial number; on Windows the SMBIOS UUID, system and board serials and the machine GUID), the trial identifier and a heartbeat every 60 seconds while the app is unlocked. The raw identifiers never leave the computer. Payment details remain with Stripe.
What never reaches the licensing service
Screen captures, transcripts, AI prompts and answers, résumés, role descriptions, employer information, source code, and Claude or OpenAI credentials.
Desktop storage
License material is kept in the platform credential store: the Keychain on macOS and Credential Manager on Windows. Profiles and session data are stored locally in application-support folders. Users should protect their OS account and disk with the security controls offered by the platform.
Capture exclusion
Pair Companion uses public OS capture-exclusion facilities where available. This is a visual privacy feature, not an anti-monitoring guarantee. Third-party conferencing tools, endpoint agents, and OS behavior can change.
Reporting a vulnerability
Email support@paircompanion.com with “Security” in the subject. Reports are read by the people who build the product; you will get an acknowledgement within two business days. Please do not disclose a suspected vulnerability publicly before we have had a reasonable chance to fix it.