Security overview
This chapter summarizes how Anthrena Desk handles data and trust for customers and IT reviewers. For the full audit write-up, see the standalone document Security audit in docs/security/audit.md (shipped with your engineering / IT pack).
Local-first
- Workbooks, sheets, charts, and connection metadata live on your machine by default
- There is no product telemetry beacon in the Desk path described here
- Opening a workbook does not upload your data to Anthrena
- Crash reports are opt-in: Desk may save a sanitized diagnostic locally after an unexpected error (Settings → Privacy). Nothing is uploaded until you choose Send (or turn on auto-send). Future signed-in sync to Anthrena/IDP uses the same queue — workbook data and file paths are not included
Architecture (trust boundaries)
| Layer | Role |
|---|---|
| Main process | Files, SQLite, DB drivers, license and plugin verify |
| UI (webview) | Charts and editing — talks to the host only through typed RPC |
| Analytics worker | In-process engine for transforms and formulas |
The UI cannot read arbitrary disk paths or run shell commands.
Secrets
| Secret | Protection |
|---|---|
| Database passwords | Encrypted at rest (AES-GCM) with a machine key |
| License key | Verified offline with a public signature check |
| Plugins | Signed packages; unsigned refuse to load in normal builds |
Payment cards and cloud identity cookies are not stored by Desk’s offline license flow.
Network
Outbound traffic is limited to:
- Auto-update (when configured)
- Optional license revalidation (when your deployment enables it)
- Plugin catalog (when a registry URL is set)
- Your database hosts for Pro connectors
- HTTPS images in display tiles
Remote scripts are not allowed in the UI shell.
Database queries
Live connectors run SELECT-only queries (including WITH … SELECT). This reduces risk from accidental write SQL.
Plugins
Missing plugins show a placeholder tile — layout and data remain intact. See Plugins.
macOS distribution (Gatekeeper)
Official Desk DMGs for macOS are Developer ID signed and notarized so Gatekeeper allows open without scary quarantine dialogs. Engineering builds without signing credentials still produce a DMG, but other Macs may block it until the recipient right-clicks → Open (or until you sign locally).
Developers: see docs/context.md (macOS codesign + notarization) — export ELECTROBUN_* in ~/.zshrc or use .env from .env.signing.example, then make check-signing and make dmg / make beta.
Limitations
- Treat this as a product security overview, not a substitute for a third-party penetration test before a major production rollout
- Plugin connectors are high privilege; follow your IT review process before installing third-party packages