Your data Two jobs, two contracts

Two jobs, two promises about your data.

Haven doesn’t copy your mailbox. It does two different things with what it reads on this computer. Scan finds what is exposed and keeps its work here. Records builds a document that is meant to leave it — and goes where you choose. They make different promises, so here they are separately.

Scan Records
Scan · email, drives and this computer

Your data stays on this computer.

What is exposed?

  • Your email, drives and files are read here. Scanning happens on this computer; Haven never receives a copy of your inbox, your drive or your files.
  • Findings stay here. They live in an encrypted store on this computer, and your sign-ins stay in the operating system’s keychain.
  • One narrow, visible exception. Most checks run on your device. For the small share it can’t decide, Haven uses your own GPU when it can; otherwise one bounded, redacted excerpt of no more than 2 KB goes to Haven’s own GPU, is judged and discarded — never a whole file or thread.
  • Fixes happen in your own accounts, and supported actions can be undone for 30 days.
  • Every outbound request is listed in the app’s Logging tab.
Records · Trace, Settle, Prepare

A record goes where you choose.

What exists, and who will need it?

  • Your mail is read here. Haven reads through the provider from this computer. Settle connects someone else’s mailbox read-only and never scans it for findings.
  • Haven’s private model is used, and named. To tell an insurer from a newsletter it sees a sender’s name and address, a few subject lines and the closing lines of up to two messages; to write summaries, the finished register; for a Deep Trace or a question, short redacted excerpts. All of it is scrubbed first, never stored, never sent to an outside AI provider, and listed in Logging — and the record says what the model saw.
  • The record is yours to send. It saves as a folder on this computer, in the place you pick. Saving straight to your own Google Drive or OneDrive is coming. A record never goes to Haven.
  • What you write in Prepare stays here, leaving only inside a record you choose to save. Prepare refuses passwords and full account numbers.
  • Anyone can check it at havenprotect.app/verify, in their own browser, with nothing uploaded.
Side by side

Where each job draws the line.

ScanRecords
Where your content is readOn this computerOn this computer
What reaches Haven’s GPUFor a hard case only: one redacted excerpt of at most 2 KB, when your own GPU can’t run the checkScrubbed sender details and subject lines, the finished register, or short redacted excerpts — for the steps each record names
What it producesFindings, kept in an encrypted store on this computerA signed document and manifest, made to be handed on
Where that output goesNowhere; it stays hereA folder you choose on this computer — or, coming, your own Google Drive or OneDrive
What it changesYour own accounts, when you choose a fixNothing in the mailbox
How you check itLogging lists every requestLogging, and havenprotect.app/verify for the record itself

Looking for the scan itself? How a scan works is on the homepage, and the transparency report has the numbers behind it.