How Satori keeps your data safe.

• Signed and notarized. Satori is signed with a Developer ID certificate and notarized by Apple. macOS may ask you to confirm the first time you open an app you downloaded; there is no malware or unidentified-developer warning.
• Checked updates. Updates arrive through Sparkle. Satori installs an update only if it is signed with Satori's update key.

• Encrypted with AES-GCM. History, open tabs, bookmarks, downloads, and hidden elements are stored in encrypted files under ~/Library/Application Support/Satori/.
• Key in the login keychain. The files are protected from other apps and other macOS accounts. Settings, site icons, extensions, and the data websites store (cookies, caches) are not encrypted by Satori.
• Names hidden. Site icons are saved under names made with a keyed hash, and per-site settings such as colors, mute, and reading position are stored in macOS preferences under the same kind of hashed name, so neither lists the sites you visited. Sites where you paused the Shield blocker or chose never to save a password are listed by name in preferences.

• Stored in the macOS keychain, as internet passwords labeled Satori.
• Never filled in by themselves. Satori offers them under the address field, and a password fills in only after you click its account. The one exception is the sign-in dialog for a password-protected folder, which Satori answers only over https, when there is one saved login for that site.
• Show and Copy ask for Touch ID or your account password.
• A copied password is marked concealed, so clipboard managers skip it, and it is cleared from the clipboard after a minute unless you copy something else.

• Each tab is its own WebKit view, and WebKit runs pages in separate content processes, as in Safari.
• Ads and trackers are blocked by default. The blocking rules ship with the app and are enforced by WebKit. Satori does not download filter lists. Satori does not turn off WebKit's own tracking protections.
• Addresses that mix alphabets, or spell a Latin name with lookalike Cyrillic or Greek letters, stay in their xn-- form.
• Chrome extensions are switched off for now, except Bitwarden. Bitwarden reaches only what its manifest asks for, and an update that adds permissions or sites asks you again.

Satori trusts the Russian Ministry of Digital Development's root certificate only for addresses ending in .ru, .su, and .рф. You can turn this off in Settings › Privacy & Security.

Write to security@satoribrowser.com. Say which part of Satori is affected and which version you use, and add steps to reproduce if you have them. We will reply by email.

Ordinary bugs and questions go to GitHub Issues. Issues are public, so keep security details out of them.