Is Littlebird safe? An honest answer
Littlebird is safe by the standards that can be audited: AES-256 encryption at rest and in transit, TLS 1.3 on every connection, SOC 2 certification, no training on your data, no selling of it, and deletion controls you hold. The fact worth stating up front rather than burying: the memory it builds is encrypted and stored in the AWS cloud, not on your device. This page gives you both halves.
Where your data actually lives
The app runs on your computer. The memory it builds is encrypted and stored in the AWS cloud, in the US East region. That is the accurate one-line frame, and we lead with it because a tool that watches your work does not get to be vague here. Anything you read elsewhere claiming the data never leaves your machine is wrong.
How it is protected
Encryption is AES-256 at rest and in transit, every connection uses TLS 1.3, and keys are managed with AWS KMS. The service is SOC 2 certified, meaning the controls are independently audited, with GDPR-aligned and CCPA-aligned data handling. HIPAA support is conditional: it requires accepting a Business Associate Agreement in-app (Settings > Data Controls) and enabling HIPAA, and protected health information should not be entered until that is in effect. Infrastructure and controls are regularly audited and tested by third-party security firms, and the details live at trust.littlebird.ai. One precision note, because the difference matters legally: SOC 2 is the certification; GDPR and CCPA describe aligned data handling, not certificates.
What happens to your data commercially
We never sell your data and never train models on it. Data is used only in ways you explicitly approve. Our customers are our users, not advertisers, and the business model is the subscription you can see on the pricing page, not your information.
What you control
Littlebird observes only with your consent. The app requires user-granted macOS accessibility permissions, and you decide if it runs at startup. You can pause context collection whenever you want, exclude specific apps entirely, and delete your data at any time, all of it or just the last hour or day. Deleting your account removes it too. Nothing is collected without your permission.
Who should not use it
People who require local-only systems, honestly. For individual and consumer users the product is cloud-based, and while the team is working to bring more processing local, cloud storage may be disqualifying if your threat model or your contracts demand that data never leave the machine. Self-hosted deployments exist at the Enterprise tier. If that is not available to you, a genuinely local tool is the right call, and we would rather say so here than have you find out after installing.
Common questions
Is my data secure?
Yes. Encrypted at rest and in transit, SOC 2 certified, GDPR-aligned and CCPA-aligned data handling, delete anytime.
Where is my data stored?
Cloud, on AWS (US East), encrypted. The app runs on your computer and you control what it sees.
Do you train models or sell data?
No and no. Our customers are our users, not advertisers.
Can I keep everything local?
Not on individual plans yet. Self-hosting is available at the Enterprise tier. If local-only is a hard requirement, Littlebird may not be the right fit today.
The trust page you actually wanted is the honest one.
Read the full posture at the Trust Center, then try the free plan knowing exactly what you agreed to.
All security facts come from our maintained internal fact base and littlebird.ai/privacy.
