Trust & security
What we do to protect your data, and what we can't promise.
Local first
Profiles live on your PC. The app works fully offline and without an account.
End-to-end encrypted sync
Your password is stretched with Argon2id on your device. Profiles are encrypted with XChaCha20-Poly1305 before upload. The server never sees keys or plaintext.
Recovery kit
Because we can't decrypt your data, you get a recovery code at sign-up. Keep it safe.
Local API is locked down
The automation API listens on 127.0.0.1 only and requires a token. CORS is closed to websites.
Account protection
Optional TOTP two-factor login, session list, rate limits, and audit logs for team actions.
Payments
Card and crypto payments are handled by the payment provider. We never see card numbers. Currently sandbox only.
Honest limits
No anti-detect tool is undetectable. We test fingerprint consistency, but we don't promise any site won't notice.
Ethical use
The Acceptable Use Policy bans fraud and abuse. We respond to abuse reports.
Report a vulnerability
Email support@blendbrowser.com with steps to reproduce. Please give us 90 days before public disclosure. We don't have a paid bounty yet.
Report abuse
If you think someone is using Blend for fraud or abuse, contact us at the same address. See the Acceptable Use Policy.