Most business software has a login page on the public internet. It is convenient, because you can sign in from anywhere, and it is also the most attacked surface the product has. Credential stuffing, phishing pages that imitate it, and automated attacks all start there.
IVOKER does not have one. It opens only in the signed IVOKER desktop app, and invited accounts sign in with a password and an authenticator code on a registered computer.
Why we made that trade
IVOKER is a private AI operator. With a firm’s permission, it can read connected mail and files and carry out work on a Windows computer. That is powerful, and it means an attacker who got into an IVOKER account would get far more than a chat history. We wanted access to require three things an attacker is unlikely to have at once:
- The right person’s password.
- Their authenticator code.
- A computer we have registered for that account.
Removing the web login takes away the most common way in. There is no page to phish, no public endpoint to hammer with stolen passwords, and no way to sign in from an unknown machine in another country.
What it costs
The trade-off is convenience. You cannot use IVOKER from a hotel business center or a borrowed laptop. Setting up a new computer takes a deliberate step. For the work IVOKER does, which is drafting, research, and authorized tasks inside a firm’s own environment, we think that is the right balance.
The rest of the model
The desktop app is one layer. Others matter as much:
- Each firm’s information is scoped to that firm.
- Mail, file, and computer access are optional and require consent.
- Mail does not send until a person approves it.
- Connections are encrypted and work is backed up.
None of this is a third-party certification. It is how the product is built, and we are happy to walk any client through it in detail during a demo.
Written by Syntonyl team. This article is general information, not legal, tax, or financial advice.