Security

What we actually do — and what we don't claim.

What we do

• Local-first: your sales data lives in a SQLite database you control — no multi-tenant cloud store in v1.
• No secrets in code: SMTP credentials and all config come from environment variables.
• Input validation on every command: state codes, dates, and amounts are validated before import.
• We are not SOC 2 certified. We publish exactly what the software does and doesn't do instead.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+nexusradar@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.