Trust and verification

The premise

Monitoring software has burned people before: silent telemetry, required accounts, bundled extras, numbers that turned out to be guesses. We can't ask you to trust us because we say so. What we can do is sign everything, document what the app sends, and publish it so you can check.

What touches the network

Aikonic makes two kinds of network connection, and only two. First, licence issuance and verification: on first launch the app requests a licence (all tiers, including free Clarity), and it re-verifies periodically, roughly daily. That request carries the licence key or its validation status, a privacy-preserving, non-reversible hashed device fingerprint, and the app's version and product identifier. Nothing else.

Second, update checks: the app requests a small version file from aikonic.app. This happens automatically when the app starts, periodically while it stays open (about every six hours), and immediately when you press Check for updates in Settings. The request carries only the app's own version number, in its User-Agent. Nothing from your snapshots, no identifiers, no account. Aikonic never downloads or installs an update on its own: it shows a banner, and only if you choose to update does it fetch the signed installer, verify it against a key built into the app, and run the install. Installing is always your decision.

No hardware readings, no usage data, no behavioural data, no crash reports. Nothing from your machine leaves your machine. Your history (in Control) is a local file on your disk. The full policy is in plain language at /privacy, and it changes in the same release as any code that touches the network, never after.

Don't take our word for it

Run Wireshark, or any packet capture, with Aikonic open. You should see the two connections above and nothing else. If you ever observe traffic this page doesn't describe, treat it as a security issue and email [email protected].

Signed and checksummed

Every installer, and every binary we build inside it, is Authenticode-signed by Hancock Technologies. The one exception is Microsoft's own .NET runtime files, which we bundle and which keep their Microsoft signatures rather than being re-signed by us. From launch, each release is published with its SHA-256 checksum on the download page, so you can verify what you fetched matches what we built, before you run it.

About kernel drivers

Aikonic ships exactly one kernel driver of our own: small, read-only, Microsoft-attested and EV-signed like every binary we build. It exists because the open-source WinRing0 driver most hardware monitors historically relied on has a known vulnerability, sits on Microsoft's Vulnerable Driver Blocklist, and is refused on modern Windows (the full story). The earlier 1.0 release carried no driver of our own and showed the affected sensors as unavailable instead. Security reviewers and press can request the driver's full threat model at [email protected].

What we won't claim

You'll never read "military-grade", "unhackable", or "100% private" here. We can't prove a negative. Aikonic is built on the open-source LibreHardwareMonitor sensor library (MPL-2.0), credited and licensed accordingly.

Report a concern

Security or privacy concerns: [email protected]. Everything else: [email protected].