Last updated: October 17, 2026
Account, workspace, and administrative access.
Neurion uses Clerk for website sign-in and account session management. Account requests are authenticated on the server. Access to a workspace is checked against the signed-in user and the workspace associated with the request; changing an address, identifier, or value in the browser does not grant access to another account.
Connecting Neurion Desktop is a separate action from signing in to the website. The connection flow asks you to confirm the local application and uses a one-time, expiring authorization bound to the requesting device. Only confirm a connection that you started yourself.
Administrative access is separate from customer access. The administration service verifies Cloudflare Access authentication and the operator's active status and required permissions. A customer account or paid subscription does not grant administrative privileges. Administrative changes also require a request from the administration site's own origin.
Protect your sign-in details, review account sessions and connected devices, and contact support immediately if you identify access you do not recognize. Standard subscriptions are for one user; creating a workspace does not turn an account into a shared team subscription.
Profile & security ↗ (/account/profile)
Tool access follows the task you authorize.
Files, commands, browser actions, and connected tools have consequences outside the conversation. Before starting a task, review its working location, permitted actions, and permission mode. Grant only the access needed for that task, and keep backups of important work before authorizing changes.
Browser tools act within the browser surfaces and sessions made available to them. Treat an authenticated browser session, terminal, or enabled computer-control tool as access to real accounts and files. Broader permission settings are not a promise that each individual action will ask for confirmation.
An MCP server or plugin is a separate tool provider. Before connecting one, review what it can read, change, execute, or send to its own service. Connecting a server does not independently verify its publisher, code, or data practices. Enable only integrations you trust, and disable or remove those you no longer need.
Inspect generated code and proposed changes before applying them. Instructions found in a document, website, repository, or tool response do not establish your permission to act on another system.
BugBot and CyberBot: authorization, scope, and evidence.
Use BugBot and CyberBot only on code, devices, applications, and systems you own or are explicitly authorized to assess. Define the target, included files or services, exclusions, and permitted actions before starting. Access to a testing tool does not grant permission to test its target.
BugBot reviews code and investigates defects. Repair is a separate authorized action: a finding is not, by itself, permission to modify a project. Review the proposed change and the verification results before relying on a repair.
For CyberBot, keep the authorized targets and exclusions specific. A test environment or container helps organize execution; it does not authorize contact with unrelated systems or eliminate the effects of network requests and tools. Use a controlled environment for work that can change state or disrupt a service.
A generated finding, successful command, or completed scan is not proof that a vulnerability is exploitable, a fix is complete, or a system is secure. Validate the evidence, reproduce the relevant behavior within the authorized scope, and retest changes. Neurion does not guarantee detection of every defect or vulnerability.
Local work and online processing.
Desktop conversation history, working files, tool outputs, and reports are stored on your device. Signing in to the same account on a second computer does not automatically transfer that local history. Keep the local backups you need.
When you use AI or a connected online feature, the content required for that operation is processed online. This includes the message and relevant context, selected document or image content, and tool results needed for the task. Account, subscription, usage, and security records are also processed on the server. Local history does not mean that every task runs offline.
Select task inputs deliberately. Remove credentials and unrelated confidential information from material you submit. A connected MCP server or external tool processes information according to its own service and privacy terms. HydraLabs' data practices, retention rules, and your rights are explained in the Privacy Policy.
Account export covers supported server records for the selected workspace; it is not a backup of every local conversation or file. Account deletion closes account access and starts the relevant cleanup processes. It does not remotely erase local files, downloaded exports, or independent third-party accounts.
Application and update integrity.
Download Neurion through the official HydraLabs download page. The application checks its packaged runtime files against the release's integrity information before starting the runtime. The update flow verifies the expected download configuration, artifact sizes, and checksums before making an update available to install. A failed integrity check stops that operation and reports an error.
File integrity checks detect a mismatch with the expected release; they are different from an operating-system publisher certificate. A release without a Windows publisher signature can trigger a Windows warning. Do not bypass a warning for a file obtained from an unrelated website or message.
Keep Neurion and your operating system current. If an update or startup verification fails, record the version and error code and contact support. Do not replace runtime files with downloads from unverified sources or delete your local work to troubleshoot a verification error.
Security controls reduce risk; they do not provide absolute protection. Review the Privacy Policy for data processing and retention.
Report a security concern.
Send security reports to support@hydralabs.ai. Include the affected feature and version, the steps needed to reproduce the issue, the expected and observed behavior, and a concise explanation of the security impact. Add a request ID or error code when one is available.
Use the smallest reproducible example and redact screenshots and logs. Do not send passwords, verification codes, session cookies, API keys, full payment card details, or private project archives in an initial report. If further evidence is necessary, agree on the transfer method with support first.
Investigate only within your authorization. Do not access another person's account or data, disrupt the service, or retain information unrelated to the report. If you encounter another person's data unexpectedly, stop that activity and report what you observed without collecting more.
A report is reviewed using its reproduction details and impact. Sending a report does not extend your testing permissions or create a reward entitlement. Coordinate further testing and disclosure with HydraLabs through the same support channel.
Security and privacy contacts.
For security reports, account access, privacy requests, and product support, contact support@hydralabs.ai (mailto:support@hydralabs.ai).
For general inquiries, contact contact@hydralabs.ai (mailto:contact@hydralabs.ai).
For billing and cancellation rules, read the Terms of Use and Subscription. The Privacy Policy explains personal data processing and data rights.