Security and trust

A local product with a verifiable distribution chain

Our threat model starts with installers, updates and database protection. These are the current guarantees and the beta’s visible limitations.

Less transmitted data

Search, exploration, engines and databases run locally. A connector contacts only the provider you selected.

Identifiable artifacts

Each release has a number, source references and SHA-256 checksums. Distributed files are immutable and limited to authorized testers.

Sources you choose

No main database is downloaded during installation. You decide which files and public sources feed each database.

Minimal web surface

This first site version has no user account, payment, sensitive form or advertising script.

Website protection

  • Restrictive Content Security Policy
  • Protection against iframe embedding
  • Referrer reduced to the strict minimum
  • Camera, microphone and geolocation permissions disabled
  • Strict HTTPS in production

Known beta limitations

  • Applications are not yet signed with commercial certificates.
  • Apple Gatekeeper, Windows SmartScreen or antivirus software may warn.
  • A signed automatic update mechanism is not available yet.

Verify your download

The private beta portal shows the received file’s SHA-256 checksum. If the values differ, do not run the file.

Private beta

Report a security issue

Do not publish exploitable details. During the private beta, contact the Grimoire team member who invited you so that we can arrange coordinated disclosure.