On your laptop, encrypted
Data at rest uses SQLCipher encryption with a key derived from the platform keychain. There is no cloud replica of your captures.
Controls your IT team will expect.
Three lanes cover how Overshow treats your data: at rest, in use, and in transit. The first two never leave your laptop. The third carries sign-in and billing, plus the queries and snippets a cloud AI client you approve exchanges with its provider.
How Overshow handles data
Processed locally
Data in use stays on the machine. Screen reading, transcription, embeddings, and semantic search run without sending frames, audio, or queries away.
Sign-in and billing by default
Data in transit covers account, billing, device registration, and aggregate licence state. Captured content joins it only through opt-ins you control: an approved cloud AI client sends its queries and returned snippets to its own provider, and approved local clients keep everything on the machine.
The specifics, for your reviewer.
Whole-database encryption, a key that never leaves the platform keychain, and a capture pipeline that keeps text rather than pixels. These are the details a security review actually asks about.
Technical summary
DatabaseSQLCipher, AES-256-CBC
Key derivationHKDF-SHA256, keychain secret
Search indexFTS5 and local vectors
Screen framesRead, then discarded
Meeting audioTranscript retained locally
A deliberately boring identity model
Standard sign-in
Magic link by email, or Google and Microsoft Entra ID SSO. No passwords to manage or leak.
One active device
Signing in on a second Mac signs the first one out. Capture and billing stay linked to a single machine.
Clean uninstall
Drag the app to the bin and delete one support folder. There is no server-side copy to chase afterwards.
Put it in front of your security team.
For enterprise pilots we walk reviewers through the data flow, encryption, and sub-processors, one by one.