Security overview
This chapter summarizes how Anthrena Desk handles data and trust for customers and IT reviewers. For the full audit write-up, see the standalone document Security audit in docs/security/audit.md (shipped with your engineering / IT pack).
Local-first
- Workbooks, sheets, charts, and connection metadata live on your machine by default
- Product telemetry is curated and sparse: allowlisted journey events (e.g. app open, gate/export/connector outcomes, update success/fail) queue locally and upload only when signed in, at most once per day in batches — never workbook contents, file paths, SQL, or
activity_log. A separate Desk-HMAC install ping (install id + app version / OS / channel only) may upload without sign-in so fleet stats can count anonymous installs — still not a public API. You can pause journey telemetry in Settings → Privacy - Opening a workbook does not upload your data to Anthrena
- Crash reports are opt-in: Desk may save a sanitized diagnostic locally after an unexpected error (Settings → Privacy). Nothing is uploaded until you choose Send (or turn on auto-send). Signed-in sync to Anthrena uses the same outbox — workbook data and file paths are not included
Architecture (trust boundaries)
| Layer | Role |
|---|---|
| Main process | Files, SQLite, DB drivers, license and plugin verify |
| UI (webview) | Charts and editing — talks to the host only through typed RPC |
| Analytics worker | In-process engine for transforms and formulas |
The UI cannot read arbitrary disk paths or run shell commands.
Secrets
| Secret | Protection |
|---|---|
| Database passwords | Encrypted at rest (AES-GCM) with a machine key |
| License key | Verified offline with a public signature check |
| Plugins | Signed packages; unsigned refuse to load in normal builds |
Payment cards and cloud identity cookies are not stored by Desk’s offline license flow.
Network
Outbound traffic is limited to:
- Auto-update (when configured)
- Optional license revalidation (when your deployment enables it)
- Plugin catalog (when a registry URL is set)
- Your database hosts for Pro connectors
- HTTPS images in display tiles
Remote scripts are not allowed in the UI shell.
Database queries
Live connectors run SELECT-only queries (including WITH … SELECT). This reduces risk from accidental write SQL.
Plugins
Missing plugins show a placeholder tile — layout and data remain intact. See Plugins.
macOS distribution (Gatekeeper)
Official Desk DMGs for macOS are Developer ID signed and notarized so Gatekeeper allows open without scary quarantine dialogs. Engineering builds without signing credentials still produce a DMG, but other Macs may block it until the recipient right-clicks → Open (or until you sign locally).
Developers: see docs/context.md (macOS codesign + notarization) — export ELECTROBUN_* in ~/.zshrc or use .env from .env.signing.example, then make check-signing and make dmg / make beta.
Limitations
- Treat this as a product security overview, not a substitute for a third-party penetration test before a major production rollout
- Plugin connectors are high privilege; follow your IT review process before installing third-party packages