Security
How Restep keeps your work, your account and your Mac safe.
In short
- Your work stays local
Recordings, screenshots and everything Restep reads are processed and kept on your Mac.
- Nothing runs unasked
A Restep acts on your Mac only after you review it and press Run, for that run alone. Esc stops it at once.
- Keys in the Keychain
Your sign-in and any service keys are kept in your Mac’s Keychain. Passwords you type are never recorded.
- Tell us privately
Found a vulnerability? Email security@restep.io, and please give us time to fix it before sharing.
A plain-language summary. The full text below is what applies.
Data on your device
Restep is built to work on your Mac. What it captures as you record, and what it reads and renders as it runs, is processed and stored on your Mac, not on our servers.
- Recordings, their screenshots, transcripts, translations and narration are kept in Restep’s folder on your Mac.
- Speech recognition, screen reading and translation run on your Mac.
- Restep’s own windows are never captured, and text typed into password fields is never stored.
- Something leaves your Mac only when you publish or share it, or turn on a feature that asks first.
To be completedWhere exactly data is stored on disk, how to delete it, and how long published content is kept on our servers.
Encryption in transit and at rest
Whatever Restep sends to our servers, it sends over an encrypted connection.
- Your account’s tokens are kept in the macOS data protection Keychain, on this device only.
- A password you set on a shared Rescreen link is kept as a salted hash; the password itself never leaves your Mac.
To be completedThe TLS versions we require, and how published Resteps, videos and account data are encrypted at rest on our servers.
Accounts and sign-in
You don’t need an account to record and run Resteps on your Mac. When you sign in, it is with your Restep account, through a standard, secure sign-in flow.
- Sign-in uses OpenID Connect with PKCE; Restep never sees your Google password.
- Access tokens are short-lived and renewed automatically. Signing out removes them from your Mac.
To be completedPassword requirements, two-factor sign-in, session lengths, and how to close your account and delete its data.
Permissions on your Mac
macOS asks you to allow Screen Recording and Accessibility before Restep can record or run anything. Revy also asks for the microphone, the first time you summon it.
- Every recording starts from a sheet that says what will be captured.
- A run needs your go-ahead each time: it covers only the steps you reviewed, and must start within two minutes.
- Esc, or typing, stops a run at once. Your own mouse stays yours throughout.
- Features that send anything off your Mac ask first, and are listed in Settings to take back.
To be completedWhy the app runs outside the Mac App Store sandbox (the Accessibility features need it), and how it is signed and notarised.
Infrastructure
When you publish, your Resteps and videos are stored with our service providers so others can open them.
To be completedOur hosting and storage providers and their regions, how access to production is controlled, backups, monitoring, and how updates to the app are signed and delivered.
Reporting a vulnerability
If you believe you have found a security issue in Restep, please tell us privately first, with enough detail for us to reproduce it. We’ll acknowledge your report and keep you updated while we fix it.
Email security@restep.io.
To be completedOur response times, scope, safe-harbour terms for good-faith research, and a PGP key if we offer one. The address above is a PLACEHOLDER until the mailbox is confirmed.