Security

YantraOS is a bounded AI agent system. It interprets a natural-language request, proposes a limited action, asks the user to confirm before system access, and records the action in an audit trail. This model is intended to make AI involvement, user control, and review visible.

Security is not a one-time feature or a guarantee. We design for layered controls, reviewable behavior, and rapid investigation when a potential issue is reported.

• Application launching is limited to configured allowlisted applications.
• File operations are scoped to a managed folder and are designed to avoid overwriting an existing destination.
• Browser and desktop actions are supervised: YantraOS presents an action for confirmation before acting.
• YantraOS does not provide unrestricted shell or root access by default.
• Actions requiring system access are recorded in an audit trail for review.

Some supervised features use screenshots and natural-language instructions to reason about a visible interface. A screenshot can expose anything visible on screen, including personal or confidential data. Only enable a request after reviewing the visible context and confirming that you are authorized to share it for the requested task.

AI model processing is provided through the services listed in our Subprocessors Disclosure. Provider behavior can vary by model, deployment, safety setting, and service configuration.

You can review a proposed action, decline it, and inspect the resulting audit trail. Use only the application and folder permissions needed for your task. For the public alpha, test in a disposable virtual machine and maintain independent backups before experimenting with system or file actions.

Do not use YantraOS to approve irreversible, high-impact, financial, medical, legal, employment, or safety-critical actions. AI may misread a visual interface or produce an unsuitable proposal even when it is operating within its configured boundary.

When we become aware of a potential security incident, we assess, contain, investigate, and remediate it as appropriate. We will notify affected users, providers, or regulators when required by applicable law. We may limit access while investigating an issue that could endanger users or the Service.

To report a suspected vulnerability, boundary bypass, or security issue, use the Contact page with the subject “Security Report.” Include the affected release, clear reproduction steps, and the potential impact. Do not include credentials, private keys, or other sensitive data in an initial report.

Please give us a reasonable opportunity to investigate and remediate before publicly disclosing a report. Public technical information about the current release is available in the YantraOS security model on GitHub.

No product can eliminate all security risk. The controls described here do not guarantee that YantraOS, an AI provider, your device, or a third-party website will behave as expected. You remain responsible for your system, accounts, data, and confirmed actions.