How the software handles data
Vulos publishes an operating system and open-source apps that run on your own machine. We host nothing for you, so there is no infrastructure of ours to certify and no promises about our data centres to make. What we can describe is the thing that actually matters: the design of the software — where data sits, who holds the keys, what crosses the network, and how you check any of it for yourself.
At a glance
Six things that are true
Your data is on your box
Files, mail, calendar, contacts, notes and AI context are stored by the software on the machine it runs on — your hardware, or a server you rent. There is no copy with us, because there is no service of ours for a copy to sit in.
You hold the keys
Encryption keys and recovery phrases are generated on your machine and stay there. We hold no copy and no escrow, which means we cannot read your data and cannot recover it for you. Back up your recovery phrase; nobody else can.
Open source and auditable
Every claim on this page is checkable, because the source is public and licensed MIT OR Apache-2.0 at your option. Read it, build it, run your own copy, or fork it. Source at github.com/vul-os.
No accounts, no billing
There is nothing to sign in to at vulos.org and nothing to pay. We hold no customer records, no passwords and no payment details, so none of it can be breached, sold or subpoenaed from us. The software is free, in both senses.
Reachability you can swap
Reaching a box behind a router goes through the built-in Vulos relay — the same open-source binary, run by you — which forwards an encrypted stream. It holds no keys and cannot read what passes through it. Run your own relay nodes, go direct over your own domain, or point at an experimental broker.
Retention is yours to set
Nothing expires on a schedule of ours. The software keeps what you tell it to keep and deletes what you tell it to delete — we could not enforce a retention rule even if we wanted to, because we cannot see the data. Backups are yours to arrange too.
Plainly
What we do not claim
A procurement checklist usually asks a vendor about its own systems. Our answers are short, and it is fairer to say so up front than to dress them up:
No certifications
Vulos holds no SOC 2 report, no ISO 27001 certificate and no equivalent attestation. Those audit an operator’s controls over data it holds; we hold none, and we would rather say that than advertise an audit that describes nothing.
No residency guarantee from us
We offer no regions, because we store nothing. Where your data physically sits is decided by where you put the machine — which is a stronger residency guarantee than any region picker, and one you control rather than one we promise.
No warranty
The software is provided as is, without warranty of any kind, and we are not liable for what happens when you run it. That is the open-source licence itself, described in plain language at data processing.
Security is a matter of code, not of paperwork
What we offer instead of an attestation is the source. If you find a vulnerability, write to security@vulos.org.
Data map
Where each kind of data lives
The whole picture, in one table. Note who appears in the “can read it” column — and, more to the point, who does not.
| Data | Where it lives | Who can read it | Who decides how long it is kept |
|---|---|---|---|
| Files, mail, calendar, contacts, notes, AI context | On your box — the machine you own or rent |
| You. Nothing expires unless you say so. |
| Encryption keys and recovery phrases | On your box, and wherever you choose to keep a backup |
| You. Lose them and nobody can recover them for you. |
| Traffic between your browser and your box | Forwarded by the built-in Vulos relay you run, direct over your domain, or an experimental broker you choose |
| Nothing to retain — it is forwarded, not stored. |
| This website’s request logs | With the website host, in Johannesburg |
| Us — the only records we hold at all. |
The last row is the only one we control, and it is the only personal information we hold anywhere — the ordinary request logs of this website. They are described in full under privacy and POPIA.
Verify
How to check any of this
You do not have to take our word for it. In rough order of effort:
Read the source
The OS, the apps and the relay are all published at github.com/vul-os. Search for the network calls; there is no obfuscated blob to hide one in.
Build it yourself
Clone and build from source rather than taking our binary, and you are running exactly the code you read. The documentation walks through it.
Watch the wire
Put your box behind a firewall or a packet capture and see what it talks to. It should be the things you configured — your own domain, the broker you chose, the model provider you pointed it at.
Walk away
The strongest check is exit. Your data is in open formats on a machine you control, the licence lets you fork the whole thing, and there is no account to cancel. Nothing here depends on us continuing to behave.
Your side
What running it makes yours
Holding your own data means holding the duties that come with it. If you run Vulos for anyone besides yourself, you are the Responsible Party under POPIA — or the Controller under the GDPR — for what sits on your box. That makes updates, access control, disk encryption, backups, retention and answering data-subject requests yours to handle, along with any agreement you need with whoever rents you the machine. It is set out at data processing, and where the stakes are high it is worth your own legal advice.
Data processing
Why there is no data-processing agreement, who is responsible for what, and what the open-source licence grants and disclaims.
Sub-processors
None for user data, because we hold none. The two third parties that do exist — the website host and the code host — are listed in full.
Privacy and POPIA
The only personal information we hold, your rights under POPIA, the Information Officer, and how to reach them.
Ask a question
If a reviewer needs the architecture described in more detail — where data sits, who holds keys, what crosses the network — just ask.