Security Whitepaper · v1.2 · April 2026

Screenpipe Security Architecture

Local-first data architecture. Open source Rust capture engine. On-premise AI. Enterprise-grade access controls. Fully auditable.

1. Security Model

Screenpipe is local-first by design. All screen captures, audio transcriptions, and metadata are processed and stored on the user's device. The capture engine is written in Rust (13 crates), providing compile-time memory safety — eliminating buffer overflows, use-after-free, and data races that affect C/C++ recording tools.

2. Vision Pipeline Architecture

The vision pipeline uses an event-driven capture model — not continuous polling. Captures are triggered by user activity (app switch, click, typing pause, scroll stop, clipboard change) or visual change detection (histogram diff > 5%). This reduces resource usage while maintaining complete coverage. event_driven_capture.rs

3. Audio Pipeline Architecture

The audio pipeline captures from multiple devices simultaneously, processes 30-second segments with 2-second overlap, runs voice activity detection, speaker diarization, and transcription — all on-device. audio_manager

4. Cryptography

All cryptographic primitives use audited libraries. Parameters are from source: crypto.rs and team-crypto.ts.

5. Data Controls & PII Protection

Capture Controls

PII Detection Engine

Regex-based PII detection engine with 27 pattern categories. Uses RegexSet for single-pass detection. No ML — deterministic, auditable pattern matching. pii_removal.rs

Pipe Permission System

Each automation pipe runs with configurable access controls. Evaluation order: Deny → Allow → Default → Reject. Deny rules always take precedence. permissions.rs

6. Speaker Identification

Screenpipe includes on-device speaker diarization — all processing runs locally with no cloud dependency:

7. Enterprise Deployment

MDM Configuration

// Pushed by MDM to: <app_dir>/enterprise.json
// Or manually at: ~/.screenpipe/enterprise.json
// macOS also checks: ../Resources/enterprise.json
{
  "license_key": "your-enterprise-license-key"
}

8. Network Requests

Core functionality requires zero network requests. Capture, OCR, local transcription, search, and pipes all run offline. Network requests occur only for explicitly enabled optional features:

Enterprise deployments can run fully air-gapped with local transcription (Parakeet/Whisper) and local AI (Ollama). In this configuration the only network request is license validation, which supports 14-day offline operation.

9. AI & Transcription Providers

Screenpipe supports fully on-premise AI for both transcription and pipe execution. Enterprise users are free to use their own AI providers. Cloud AI through Screenpipe is optional and operates under zero data retention (ZDR) policies.

On-Premise Transcription

The following speech-to-text engines run entirely on-device with no network dependency. engine.rs

AI for Pipes (Automations)

Pipe execution supports multiple AI providers. Enterprise users can bring their own API keys or use fully on-premise models. pipes/mod.rs

Enterprise recommendation: For maximum data control, deploy with on-premise Ollama or a custom OpenAI-compatible endpoint. No data leaves your network. Cloud AI is entirely optional.

10. Testing & CI/CD Pipeline

Screenpipe maintains a multi-layered testing infrastructure across 14 CI/CD workflows, covering unit tests, integration tests, E2E tests, benchmarks, security audits, and longevity testing.

Security-Specific Testing

11. Compliance

12. Source Code Audit

Screenpipe is fully open source. The following modules are directly relevant to security review:

For documentation, see the Screenpipe Docs including the Pipes Guide, Pipe Permissions, Teams & Encryption, and Cloud Sync Architecture.

Security Contact

To report a vulnerability, request a security review for your organization, or discuss enterprise deployment: louis@screenpi.pe

Document version 1.2 · April 2026 · Screenpipe v2.3.x · All claims verified against source code