GlidePath Money

Security

Security, explained.

The short version: by default, your core financial file stays on your computer — we don’t host it, upload it, or keep a copy. A few optional features you can switch on send limited data off your machine; the Privacy page covers exactly what. Everything below is the architecture that makes the local-first default true.

Last updated: June 8, 2026

Local-first architecture

The default is simple: no cloud copy of your financial file.

Every transaction, balance, holding, account name, and budget category lives in plain files on your computer by default. The desktop app reads and writes those files directly. There is no central server with a copy, no aggregator with credentials, and no cloud database mirroring your financial files.

Default

Core file stays local

Accounts, transactions, balances, holdings, invoices, and planning inputs live on your computer by default.

Optional

Disk encryption is a choice

Plain files stay open and portable unless you turn on AES-256-GCM encryption at rest.

Named exits

Online touchpoints are limited

License checks, updates, support, and labeled optional features are the places data can leave.

Tradeoff

Backups stay your job

Because we do not hold a cloud copy, your DataFolder needs the backup system you trust.

Protection map

What is protected, where it lives, and why.

This is the receipt table: the surface, the protection, and the tradeoff it exists to handle.

SurfaceProtectionWhy
Your data files (transactions, balances, holdings, invoices) Plaintext by default; optional AES-256-GCM encryption at rest Plain files you can open in Excel — or turn on encryption (Setup → Data security) when you’d rather have them locked on disk.
License file on your disk Encrypted with Windows DPAPI (per-machine, per-user) License credentials can’t be lifted from your disk by another user on the same machine or by a stolen drive.
App lock password (if enabled) Argon2id-hashed; DPAPI-encrypted at rest Argon2id is the modern memory-hard KDF; DPAPI binds the hash to your Windows account.
Browser-extension uploads (bank CSVs) Posted straight from your browser to your local app on localhost The bank CSV is captured by the extension on your machine and posted straight to your local app; it doesn’t go through our servers.
Customer record (license key, email) Stored in Cloudflare D1 with access scoped to our provisioning Worker The minimum needed to issue your license, handle refunds, and remove account records when required.

Evidence notes

The details are still here. They are just easier to scan.

Local-first is a real tradeoff: you get clarity and control, but you also own your backups. These notes spell out the main choices without turning the page into one long cream wall.

Encrypting your data at rest

By default your data lives as plain files you can open in Excel. If you’d rather have them locked on disk, turn on encryption in Setup → Data security.

  • Automatic uses a key held in your operating system’s keystore (Windows DPAPI / macOS Keychain) and unlocks when you’re signed in.
  • Passphrase derives the key with Argon2id. There is no recovery if you lose the passphrase, by design.

Either way, you can export a plain copy any time.

App lock

The app supports an optional password lock with auto-lock on idle. Set it in License > Lock. The password is hashed with Argon2id and the resulting hash is DPAPI-encrypted on your disk.

Optional cloud-touching features

Glide AI is optional. When you ask a question, the request goes to our Worker proxy, which forwards it to Anthropic. We send your question text and minimal page context, not your DataFolder.

Holdings price refresh sends ticker symbols through a Worker that calls Yahoo Finance. It does not send quantities, account names, transactions, or your identity.

See the subprocessors page for full data-flow details.

TLS to our endpoints

The desktop app makes HTTPS calls to api.glidepathmoney.com for license verification, optional Glide AI questions, optional ticker-price refresh, and support feedback. The app trusts the operating system’s root certificate store.

We do not pin a specific TLS certificate or public key in the app. The tradeoff: pinning can break managed networks and certificate rotation, while local-first keeps sensitive financial files out of those endpoints.

Backups and updates

Because your data is on your computer and not in our cloud, you carry backup responsibility. The app includes an opt-in local auto-backup into a backups folder inside your DataFolder, and you should also keep an external or cloud backup.

GlidePath uses a small set of open-source libraries, listed at /third-party-notices. Library updates ship with app updates during your maintenance window; we monitor disclosed CVEs and patch when one affects a library we use.

Vulnerability disclosure and scope

Found something? Email security@glidepathmoney.com. We acknowledge reports within two business days and publish a fix or remediation plan within 30 days for confirmed issues.

This page is an overview, not a complete threat model. We do not publish penetration-test reports, and we do not hold SOC 2 or ISO 27001 attestations.