Skip to content
/docs/security

Security

Security & privacy

What's local, what's encrypted, and what leaves your device.

Levix stores its local state and WhatsApp session on your device. AI features may send the content required for a request to the AI provider you configure.

Everything else — the database, the WhatsApp session, memory files, logs — stays in one local, self-hosted directory: no telemetry, no phone-home service, nothing uploaded anywhere on Levix's own behalf.

Storage

One SQLite file, through Node's own node:sqlite module — zero external database dependency. The prefix, permissions, API keys and every setting are rows in that one file, read at call time.

Secrets

  • The panel password is never stored as plaintext — it's an scrypt hash and salt, checked in constant time, minimum 8 characters.
  • The session-signing key is 48 random bytes generated on first start and reused forever after — nobody, including the operator, ever sees it.
  • The WhatsApp session and any API keys you paste in are sealed with AES-256-GCM in a vault, using a key kept in a separate file (levix.key, mode 0600) next to the database — so a leaked database backup alone isn't enough to recover them.
  • Changing the panel password invalidates every existing session immediately, not just on logout.

Login throttling

The panel login, first-run setup and password-change endpoints share one guess-throttle: 5 attempts per 15 minutes, keyed on the connecting peer rather than a spoofable IP header.

The first-run setup code

Until a password is set, opening the panel from anywhere other than the machine it's running on also asks for a one-time code printed in the terminal at startup — so a bot that comes up on a public IP can't be claimed by the first stranger who finds the port.

What AI features send out

!gemini and friends are agents that call whichever AI provider you've configured over the network — Gemini, OpenAI, Anthropic, or an OpenAI-compatible endpoint. A message you send to the AI, along with anything it needs to answer (web search results, a quoted file, memory it reads), goes to that provider's API. Pointing the provider at a local Ollama keeps that traffic on your own machine; any hosted provider means it leaves your device.