Security & Privacy
Morphee is designed so your data stays yours. Here's exactly how.
Architecture Overview
Morphee is designed with security at every layer. The server handles API requests, authentication, and AI orchestration. All communication is encrypted. Desktop and mobile apps store credentials locally in your device's secure storage.
Encryption
In transit: All client-server communication over TLS (HTTPS). WebSocket connections are encrypted.
At rest: Database encryption depends on your server configuration. Desktop apps use your device's secure storage for credentials.
Knowledge signing: Cryptographic signatures on all shared knowledge to verify authenticity and prevent tampering.
Credential Storage
API keys, OAuth tokens, and secrets are never stored in the database. On desktop, they're stored in your device's secure storage. On server deployments, credentials are managed through secure environment configuration.
Access Control
| Layer | Mechanism |
|---|---|
| Authentication | Secure tokens with short expiry and automatic refresh |
| Authorization | Role-based: owner, parent, member, child |
| Group isolation | Complete data separation between groups — no data leaks possible |
| Rate limiting | Rate limiting on all endpoints to prevent abuse |
| Children | Separate authentication for children, no email required, age-appropriate access |
| Extensions | Sandboxed with configurable permissions — extensions can't access anything not explicitly allowed |
GDPR Compliance
Right to access
Export all your data in JSON format via the API or app settings.
Right to deletion
Delete your account and all associated data. Cascade deletes ensure nothing is left behind.
Explicit consent
Each integration and data-sharing feature requires explicit consent before activation.
Data minimization
We only collect and process data that is strictly necessary. No PII in logs or events.
Audit Trail
Every action Morphee takes is logged. Extension executions have their own audit log. Memory changes are tracked with full version history. You can review what Morphee did, when, and why — and revert anything.
Our No-Telemetry Pledge
- We do not collect usage analytics from the Morphee app or server.
- We do not track which features you use or how often.
- We do not phone home, check for updates in the background, or send crash reports.
- We do not include any third-party tracking in the app.
- The only network requests the app makes are the ones you configure (your LLM provider, your OAuth services).
This website (www.morphee.app) uses PostHog analytics with opt-in consent. The Morphee app itself has zero telemetry.
Responsible Disclosure
If you discover a security vulnerability in Morphee, please report it to security@morphee.app. We take all reports seriously and will respond within 48 hours.