Your browser ↔ OpenAI
Live microphone audio travels directly over WebRTC to OpenAI on the API key you supply. It does not pass through Sorema’s AWS account.
Security model · open beta
Security,
without euphemisms.
Sorema can ask a coding agent to work on your computer. That deserves a precise account of what crosses each boundary, what can execute, and what is not yet enterprise-ready.
Local agent source: publicIndependent audit: not completedTeam controls: not available
Data flow
Three boundaries.
Three different jobs.
Sorema control plane
AWS in Frankfurt holds account state, encrypted credentials, task status, notifications and optional memory. It sends typed requests, not an interactive remote shell.
Your computer
The open-source local agent makes an outbound connection. It starts Codex CLI or Claude Code inside a workspace you explicitly allowed.
Execution boundary
“No arbitrary exec” does not mean “no commands run.”
Sorema’s remote protocol exposes named, validated operations; it does not provide a generic cloud-to-PC shell. But the coding agent Sorema starts can run commands and edit files according to Codex or Claude’s own configuration and approval rules.
Those agent permissions remain the decisive boundary. Claude Code Chrome access is off by default and requires sorema chrome enable; Codex Chrome remains dependent on its installed plugin and runtime permissions. Sorema does not bypass either agent’s approval rules.
Workspace paths are allow-listed locally. Traversal and symlink escapes outside those roots are refused by the local bridge.
Central risk: someone who takes over your signed-in Sorema browser, a live call credential, or the Sorema control plane may submit tasks with the capabilities your Codex or Claude configuration permits. Short-lived credentials, device signatures and workspace checks reduce that risk; they do not make a compromised account harmless.
Controls today
What is enforced.
Outbound-only computers
No inbound port, public IP or router configuration is required.
Short-lived credentials
Pairing codes, call tokens and connection proofs expire and are checked at the gateway.
Per-user secrets
OpenAI keys and memory data keys are encrypted with AWS KMS; a stored API key is never returned to the browser.
Immediate deletion fence
Account deletion writes a strongly consistent marker in a separate retained table, blocking old browser, call and device credentials even after a data restore.
Atomic, retryable purge
The retained fence is also a durable stream event. Its worker waits one minute for in-flight requests, then removes live rows and the Cognito identity with retries and an alarmed failure queue.
Browser-only voiceprint
The optional speaker filter stores its mathematical voiceprint only in that browser’s IndexedDB and sends it nowhere.
Current limits
What you should not assume.
- No independent penetration test or security certification has been completed.
- No company entity, DPA, enterprise SLA, SSO, RBAC or central team policy exists yet.
- Sorema is operated by one person. It is suitable for an informed beta pilot, not enterprise procurement today.
- Task summaries and computer names rely on DynamoDB’s storage encryption, not per-field application encryption.
- Point-in-time backups from before deletion can remain recoverable for up to 35 days. The separate deletion fence keeps restored credentials blocked.
- After account deletion, HTTP and tunnel access logs can remain for one month, Lambda logs for three months, CloudFront logs for 90 days, and security audit records for up to one year.
- The device private key is protected by local filesystem permissions, not a hardware key or operating-system keychain. The local agent does not auto-update; its owner must install updates.
- OpenAI may process conversation data outside the EU according to the endpoint, settings and terms of the user’s own account; Sorema currently uses the standard OpenAI API endpoint.
Report a vulnerability
Tell the person
who can fix it.
Sorema is operated by Gabriele Nosso. Send a concise report and reproduction steps. Do not access another person’s data or disrupt the service while testing.
Email a security report