Security you can read in the code.

Nothing on this page is marketing: every claim maps to a control that lives in the open repository, and the key claims are checked against the code by the site test suite.

Data encrypted at rest

The desktop application always encrypts its local database with SQLCipher.
Backups are generated encrypted, and revealing the backup key leaves an audit record.

A sandboxed interface

The window runs under the Electron sandbox: the UI cannot touch files or processes.
Every capability crosses an explicit IPC bridge; there is no direct Node access from the screen.

One business, its data

Every server query filters by business; tests cover cross-business isolation.
Role permissions compose from shared guards, never hand-written exceptions.

Updates that do not over-trust

No update installs silently on platforms where the signature cannot be verified.
macOS packages ship signed with a Developer ID; the trust barrier is the platform signature check, not the feed.

Auditing what matters

Money, privacy and access leave a trail: who, when, before and after.
The audit viewer groups by review category so the urgent never drowns in noise.

Report a vulnerability

Open a private advisory on GitHub (Security tab → Report a vulnerability) or write to the email on the contact page.
A person answers, not a bot; the full process lives in the repository security document.

The full technical document (threat model, boundaries and decisions) lives in the repository:docs/SECURITY.md on GitHub