Security and privacy

Hollow safeguards your data: encrypted in transit and at rest, strictly isolated to your account, and never used to train third-party models without explicit opt-in consent.

Data Encryption. TLS encryption in transit across all endpoints, and strong encryption at rest for stored workspace data.
Authentication & Session Safety. Email and password sign-in backed by challenge verification and app-integrity checks. Review and revoke active sessions from Account settings.
Access Control. Server-enforced membership access control ensures no private content is accessible via unauthenticated links.
Sandbox Isolation. Email HTML content renders inside sandboxed iframes. HollowScript Code steps in Cascade are capability-isolated: a step can only reach the capabilities its uses declaration lists, enforced before any code runs.
Data Ownership. Export your notes, files, and conversation history at any time. Account deletion permanently removes associated workspace data.