Security & compliance

What Vacarme actually does to protect your data — and what you're responsible for.

Vacarme is not (yet) ISO certified. What follows is a factual account of how the app actually handles your data — every claim below is verifiable in the app's code and in our legal pages.

What we guarantee

AES-256 encryption

Credentials for the third-party accounts you connect (social networks, integrations) are encrypted before being stored.

Secrets the AI never sees

When a site asks for a password, a code sent by SMS or email, or a two-factor code, Vacarme asks you to type it yourself in a masked box. The value goes straight into the page's field: the AI never sees it and only learns how many characters were typed. The request expires after 10 minutes without an answer.

Local-first storage

Your credentials, task history, and conversation history stay on your machine. They are never transmitted to our servers.

Your API key, encrypted on your machine

The key you configure in Settings > Your AI is encrypted in your machine's system vault (Keychain on macOS, DPAPI on Windows). It is never sent to our servers.

GDPR compliant

Rights to access, rectify, and erase your data, detailed in our privacy policy.

Your Chrome, a closed list of actions

The Vacarme extension for Chrome only accepts actions from a closed list. It never reads your passwords, cookies or site storage. See Chrome extension.

Hosted in Europe

Our server infrastructure is hosted in Germany, with Contabo GmbH.

Your AI: who sees what

On the "Your AI" path (your API key, see Connect your AI), requests go straight from the app to the provider you chose. Nothing transits through our servers: Vacarme sees neither your prompts nor the replies.

The provider (OpenAI, Anthropic or OpenRouter) sees your prompts, exactly like when you use its own apps. That processing is governed by the provider's own terms.

Only a real API account is supported. A ChatGPT or Claude subscription is not an API account: the app does not accept a token from a subscription, only an API key.

What Vacarme is — and isn't

Vacarme is a software tool that you configure and direct. You choose the tasks the agent carries out, the platforms it operates on, and the accounts it uses. The agent acts exclusively based on the settings and instructions you give it.

You are the author of the actions carried out by the agent on your behalf — in the same way as if you had performed them yourself using a tool. This has concrete legal consequences:

Content responsibility. You are solely responsible for the accuracy, legality, and appropriateness of content the agent publishes, sends, or generates on your behalf.
Platform terms. Automating a logged-in social account may breach that platform's own terms of service (this is explicit and general across LinkedIn, X/Twitter, Meta, TikTok, YouTube, and Reddit). Platforms may restrict, suspend, or terminate your account as a result — Vacarme is not a party to that relationship.
Third-party account creation. Some tasks create accounts on new sites, which may involve solving a verification mechanism (e.g. a captcha). This is always a task you initiate, for a site you designate — you're responsible for having legitimate authorization to do so.
Data of people the agent contacts. If you configure the agent to reach out to, comment on, or message third parties, you become the data controller for their personal data under GDPR — not Basecamp Labs.

The full legal detail lives in our Terms of service and Privacy policy — both are shown and must be accepted when you create an account.

Deleting your account

You can request full account deletion at any time from the app's billing settings. After email confirmation, this cancels your subscription, deletes your account and profile, and anonymizes (rather than deletes) your billing history — amounts and dates are kept for the legally required accounting period, but are no longer linked to your identity. Data stored locally on your machine is not affected; you control it directly.

Plans & billing

Free, Pro, Studio. Credits, packs, and what changes with "Your AI".

Chrome extension

Let Aurora work in your own Chrome, on the sites where you are already signed in.