Security, in plain terms
We designed Frnd around one rule: even we should not be able to see your sensitive information (e.g. credentials).
Your passphrase is the key
When you connect a service — e.g. your mail — you set an encryption passphrase. It is separate from how you log in, and we only ask for it when you are adding or changing something sensitive. That passphrase is what unlocks your data. We do not store your passphrase, and we cannot recover it for you if you lose it — because if we could, so could anyone who broke in.
In other words: Neither we (nor a hacker who might steal our database) can access your sensitive data.
Where is it used?
The passphrase is used whenever we need to access your sensitive information (on your behalf). Reason is, as stated above, that your sensitive information is encrypted and only you hold the passphrase to it.
In praxis you will need to enter your passphrase in the following scenarios:
- When you add an App connection.
- When you add or edit sensitive information in Abilities.
- When you access sensitive information in the Audit log.
The first time you need a passphrase you will be asked to create one – i.e. enter the passphrase and repeat it.
Your AI Assistant also holds a key
Your connected AI Assistant holds a key of its own, separate from your passphrase. This is required so we can act on your AI Assistant's instructions without asking for your passphrase on every call.
Like your passphrase, we do not store these keys, and we cannot recover them. If you (or your AI Assistant) lose one of these keys, you will need to create a new one — that is, connect your AI Assistant to Frnd again.
You control what your AI Assistant can touch
Beyond encryption, you decide what your connected AI Assistant is allowed to do — read-only or read-write, specific folders, actions that need your approval first. And everything it does is logged, so you can check.
Hosted in Denmark, under European law
Frnd runs on servers in Denmark, at a Danish hosting provider. That is a deliberate choice: We prioritise European infrastructure — and found a suitable provider right at home.
- Your data stays in the EU. Everything Frnd stores sits on servers in Denmark.
- One legal system, end to end. Frnd and its hosting both operate under EU law – GDPR is simply the law of the land.
- No foreign access laws. A Danish provider on Danish soil cannot be compelled by non-EU disclosure laws such as the US CLOUD Act.
In other words: the servers, the company running them, and the law governing them are all European. And your sensitive data is encrypted with keys we never hold – so location is the second wall, not the first.
For the technically curious
Each user has a randomly generated 256-bit Data Encryption Key (DEK), which encrypts service credentials and sensitive policy configuration. The DEK itself never touches disk unencrypted — it is wrapped by one or more Key Encryption Keys (KEKs), each coming from a different source:
- Your encryption passphrase (run through Argon2id) derives a passphrase KEK that wraps the DEK. Argon2id is a memory-hard key derivation function designed to resist brute-force attacks.
- If your AI Assistant connects via OAuth, the refresh token issued during that flow carries a second KEK which wraps the same DEK as a separate copy.
- If instead you generate an API key yourself and hand it to your AI Assistant, that key carries its own KEK the same way.
Either path lets your AI Assistant operate without your passphrase on every call — it never sees the passphrase, and revoking a key only revokes that copy, independently of the others.
All key wrapping uses post-quantum-safe algorithms. Decrypted keys are held in memory only for the duration of a single operation, then dropped.