Default
Security
Security, explained.
The short version: by default, your core financial file stays on your computer — we don’t host it, upload it, or keep a copy. A few optional features you can switch on send limited data off your machine; the Privacy page covers exactly what. Everything below is the architecture that makes the local-first default true.
Last updated: August 2, 2026
Local-first architecture
The default is simple: no cloud copy of your financial file.
Every transaction, balance, holding, account name, and budget category lives in plain files on your computer by default. The desktop app reads and writes those files directly. There is no central server with a copy, no aggregator with credentials, and no cloud database mirroring your financial files.
Optional
Disk encryption is a choice
Plain files stay open and portable unless you turn on AES-256-GCM encryption at rest.Named exits
Online touchpoints are limited
License checks, updates, support, and labeled optional features are the places data can leave.Tradeoff
Backups stay your job
Because we do not hold a cloud copy, your DataFolder needs the backup system you trust.Protection map
What is protected, where it lives, and why.
This is the receipt table: the surface, the protection, and the tradeoff it exists to handle.
| Surface | Protection | Why |
|---|---|---|
| Your data files (transactions, balances, holdings, invoices) | Plaintext by default; optional AES-256-GCM encryption at rest | Plain files you can open in Excel — or turn on encryption (Setup → Data security) when you’d rather have them locked on disk. |
| License file on your disk | Windows: DPAPI (per-machine, per-user). macOS (Apple Silicon): wrapped by the Keychain. Linux: your keyring, or plain on disk if the machine has none. | OS protection helps prevent copying on Windows 11 (24H2 or newer), macOS (Apple Silicon) and Linux with a working keyring. On Linux without a keyring, the license file is plaintext and can be read from a stolen drive unless the drive itself is encrypted. |
| App lock password (if enabled) | Argon2id-hashed, then protected the same way as the license file | Argon2id is the modern memory-hard KDF; the platform keystore binds the hash to your account where one is available. |
| Browser-extension captures (bank CSVs and PDFs) | Posted from your browser to the app address in extension Settings: localhost by default, or a remote address you choose | A remote address receives the captured file and bank-page metadata over the network. A separate, optional bank-support diagnostic can reach our API if you enable it. See the privacy policy for the scope and locally held CSV details. |
| Customer record (license key, email) | Stored in Cloudflare D1 with access scoped to our provisioning Worker | The minimum needed to issue your license, handle refunds, and remove account records when required. |
Evidence notes
The details are still here. They are just easier to scan.
Local-first is a real tradeoff: you get clarity and control, but you also own your backups. These notes spell out the main choices without turning the page into one long cream wall.
Encrypting your data at rest
By default your data lives as plain files you can open in Excel. If you’d rather
have them locked on disk, turn on encryption in Setup → Data security.
- Automatic uses a key held in your operating system’s keystore (Windows DPAPI / macOS Keychain) and unlocks when you’re signed in.
- Passphrase derives the key with Argon2id. There is no recovery if you lose the passphrase, by design.
Either way, you can export a plain copy any time.
App lock
The app supports an optional password lock with auto-lock on idle. Set it in
License > Lock. The password is hashed with Argon2id and the resulting
hash is DPAPI-encrypted on your disk.
Optional cloud-touching features
Glide AI is optional. When you ask a question, the request goes to our Worker proxy, which forwards it to Anthropic. We send your question text and minimal page context, not your DataFolder.
Holdings price refresh sends ticker symbols through a Worker that calls Yahoo Finance. It does not send quantities, account names, transactions, or your identity.
AI categorization is optional and opt-in. When you run it, the app sends, for each transaction in the batch you chose, the payee text, the amount, the date and the account type, plus your category names — never account names, balances, holdings, or owner.
The weekly digest email is off until you turn it on. It carries a first name, the date range and an activity summary, redacted of amounts, balances and account names unless you explicitly switch on detailed emails.
Mobile sync is off on a default install. Once you enable it and pair a phone, it carries your license key for desktop writes, device IDs and tokens, the pairing values, and the sync blobs the phone reads.
See the subprocessors page for full data-flow details.
TLS to our endpoints
The desktop app makes HTTPS calls to api.glidepathmoney.com for license
verification, optional Glide AI questions, optional ticker-price refresh, and support
feedback. The app trusts the operating system’s root certificate store.
We do not pin a specific TLS certificate or public key in the app. The tradeoff: pinning can break managed networks and certificate rotation, while local-first keeps sensitive financial files out of those endpoints.
Backups and updates
Because your data is on your computer and not in our cloud, you carry backup responsibility. The app includes an opt-in local auto-backup into a backups folder inside your DataFolder, and you should also keep an external or cloud backup.
GlidePath uses a small set of open-source libraries, listed at /third-party-notices. Library updates ship with app updates during your maintenance window; we monitor disclosed CVEs and patch when one affects a library we use.
Vulnerability disclosure and scope
Found something? Email [email protected]. We acknowledge reports within two business days and publish a fix or remediation plan within 30 days for confirmed issues.
This page is an overview, not a complete threat model. We do not publish penetration-test reports, and we do not hold SOC 2 or ISO 27001 attestations.
- Privacy Policy — what we do and don’t collect
- Subprocessors — vendors we use and what they touch
- Third-Party Notices — open-source attributions
- security.txt — machine-readable disclosure policy
If something goes wrong
Made a wrong move? You can step back out of it.
Local-first means the recovery story is yours too — so GlidePath builds the safety in. Nothing saves until you’ve seen it, the bigger changes get a restore point first, and your money stays in local files you control.
Nothing saves until you’ve seen it
Imports stage off to the side and show you exactly what would change — how many rows would be added, which look like duplicates, sample values — before a single one is written. You commit only when it looks right.
Restore points for the bigger changes
For larger imports and high-impact system changes — like a data-structure upgrade — GlidePath creates a restore point first, and tells you the backup’s name when it makes one. Restoring from a backup snapshots your current state too.
Undo an import in one click
Pulled in the wrong file? Undo removes exactly the rows that import added — nothing else — straight from the import receipt.
A crash won’t half-write your money file
Core money-file saves go to a temporary file that is swapped in only once it is complete. Lose power mid-write and the file is whole, not half-written.
A backup you actually hold
Zip your whole data folder and download it — to a USB stick, your own cloud drive, wherever you want it. It is a file you control: no black box, no lock-in. GlidePath keeps your recent backups on hand and clears out the old ones (up to 30).
Try anything without touching your real data
Explore mode runs on a fictional household. Click around, run the scenarios, even start over — your real files are never part of it.
None of this is a setting you have to find or a tier you have to buy — it is simply how GlidePath handles your money. See how your numbers get in →