How the information is protected, and where the protection stops.
This page describes what the installed edition does today. We would rather you read the limits here than discover them later.
Where your information lives
In the installed edition the book runs on a server you control. Entries are not sent to us. The only thing that leaves your server is the daily licence check, which sends an installation ID, the version and the number of users, never entry content.
What is protected
- Entry content. What happened, where, and the extra details are encrypted with AES-256-GCM before they are written. Each sealed value is bound to its own entry, so values cannot be swapped between entries without detection.
- The licence key. Stored encrypted, shown only as a masked hint.
- Passwords. Stored as salted scrypt hashes. Sign-in attempts are rate-limited.
- Connection keys for alarm and tracking systems. Shown once, stored only as hashes.
- Backups. A backup contains sealed text, so it is not readable without the key or the recovery key.
- Deleted content. The database overwrites removed content, and an upgrade purges older readable copies from the file.
The key is kept apart from the data
The encryption key is not in the data folder. On Windows it is protected with Windows DPAPI, so it opens only for the Windows account the service runs as, on that computer, and its folder is limited to the system and administrators. A copy of the data folder, a stolen disk or a backup file does not carry the key with it.
To move to a new server, an administrator creates a recovery key (this asks for their password again and is recorded in the audit log). Print it and keep it away from the server. Creating a new one cancels the old one.
Tampering shows
Entries are chained together with a keyed checksum. The built-in integrity check recalculates the chain and reports any entry that was changed, removed or re-ordered directly in the database file, and any number that was issued without an entry behind it. Someone who does not hold the key cannot repair the chain to hide a change.
Protection in the web pages
- Strict content security rules: no inline scripts, nothing loaded from other sites.
- Sessions use secure, HttpOnly cookies. Changes made from another website are blocked.
- No public sign-up. An administrator adds each named person, and access is given book by book.
- An audit log of sign-ins, exports, backups, recovery key and integrity checks.
What it does not cover
- A person with administrator rights on the running server can still run the program and read the book through it. Control access to the server itself.
- The integrity check cannot stop someone who holds the server’s own key. It makes quiet changes visible to everyone else.
- We have not obtained an independent security certification such as ISO 27001, or a government accreditation.
- We cannot give legal advice or promise that it meets your retention, disclosure, privacy or evidence rules. Please check against your own.
- It does not protect an unlocked computer, a shared password or a phished sign-in.
What we ask of you
- Turn on Windows disk encryption (BitLocker) on the server.
- Serve it over https, with a certificate or behind your reverse proxy.
- Keep the recovery key printed and stored apart from the server.
- Restrict who can sign in to the server, and test a restore from a backup.
- Never type real information into the demo or the website chat.
Questions from your IT or security team?
Ask the assistant at the bottom of any page, or send a message and a person will reply.