On your device
The map and SQLite database stay local by default. The public website does not receive project data. Network drives, cloud-sync folders, UNC, and WSL paths are not supported workspaces.
Security
Start with three practical questions.
GrowthMap centers on one local Windows workspace; the public website remains separate from desktop project data.
01 / Where is my data?
Review exports
JSON and Markdown contain node content, including any paths, tokens, or sensitive text you entered.
02 / What can an Agent see or do?
Only the granted scope
Read, propose, or scoped write can be limited to a project, node, or branch. Agent scoped writes follow app API → validation → SQLite transaction and never direct filesystem access. This grants no filesystem, shell, Git, deployment, payment, or credential authority.
Proposal-first for judgment; explicitly authorized low-risk changes may write atomically
A proposal is not canon until approved. Bounded writes leave a receipt and action history.
03 / How can data be recovered?
Back up before risk
Full JSON can back up and restore a project. Managed backups include a SQLite snapshot and verification evidence.
Failed verification stops writes
Mismatched migration or recovery evidence stops writes and triggers a read-only or recovery path or startup refusal.
04 / Report security issues privately
Do not disclose vulnerabilities publicly
Email [email protected] privately with only a minimal redacted reproduction. Never include passwords, tokens, private keys, activation keys, complete project databases, or sensitive logs.
05 / Technical details
Local and credential boundaries
The desktop uses 127.0.0.1 loopback. Windows DPAPI wraps provider keys; grant tokens use a random salt and scrypt (N=2^14, r=8, p=1, dklen=32); SHA-256 verifies backups, manifests, and digests.
Backup verification and migration
Managed backups record SHA-256, size, and manifest; import, restore, and migration verify or create backup evidence first.
Real fail-closed conditions
Invalid or corrupt documents, wrong-major licenses, expiry, revocation, failed check-in, and an update-recovery marker trigger read-only extraction mode or startup refusal according to source contracts. Security evidence is reviewable; no completed formal third-party audit is claimed.