Security
How we hold your data
Klarion handles licence keys, payment records and the binaries you download. Here is what protects them, in enough detail to check rather than to take on trust.
Your analysis never leaves your machine
Klarion is a desktop application. Projects, databases and the binaries you open stay local. There is no telemetry, no account check at startup and no network traffic during analysis. The only thing this site knows about your work is that you hold a licence and which build you downloaded.
Licences are signed files, verified offline
A licence is an Ed25519-signed blob that the application verifies against a public key compiled into the binary. The private half is a server environment secret: it is not a database row, not an object in storage, and no client of ours can read it. The public half is published at
/api/licences/pubkey so you can check that the key your copy trusts is the key we sign with.The signature covers the bytes, not our idea of them
The signature is taken over the licence file exactly as it appears on the wire, prefixed with a format tag. A verifier never has to reproduce our JSON key order to agree with us, and a payload lifted out of this format cannot be replayed as some other signed structure. One changed character anywhere in the file, including in the signature’s own base64, fails verification. That is asserted by a test that flips every character in a sample licence, one at a time, and requires each to be rejected.
What revocation can and cannot do
Revocation is per file rather than per licence, so one decommissioned machine can be cut off without disturbing the other seats. An online seat stops at its next check-in. An offline file on an air-gapped machine cannot be reached at all. It keeps working there until it expires, whatever our revocation list says. That is a property of offline licensing rather than a defect in ours, and we would rather say so here than have you discover it during an incident.
A wrong clock does not lock you out
The verifier keeps a high-water mark of the newest time it has ever seen, so winding a clock back cannot revive an expired licence. A clock that is merely wrong (a dead CMOS battery, a fresh VM) is flagged in the interface and the licence is honoured anyway. Refusing to start because a laptop battery died is a support ticket, not security.
Row Level Security on every table
Every table in our database denies by default and grants only what the product needs. Each policy has a test that proves one account cannot read or write another’s rows, run against a seeded database rather than checked by eye. A separate test asserts against the live catalogue that no table can ever ship with the protection switched off, including a table added by a future migration that forgot the line.
Seats cannot be minted from a browser
No client role holds an insert grant on activations or licences. Seat counting happens in a server route under a service role that never touches the browser, so pointing a Supabase client at the tables with the public key achieves nothing. The same is true of the audit trail: it is append-only, written only by the server and not editable by the administrator it records.
Verify what you run
Every release is published with its SHA-256, shown on the download page and on your account page. Check it before you run the installer. The same digest comes back on the download itself, in an
X-Content-SHA256 header, so a script can verify without returning to the page it came from.The installer is deliberately not protected
There is no bucket, no signed URL and no entitlement check in front of a download. The file is served straight from this application’s own disk to anyone who asks, with no account and no licence. That is a decision rather than an omission: there is one installer for every edition and the signed licence decides which one runs, so putting the file behind a gate would mean a free edition nobody could obtain, and it would put the customer database in the path of the one request we most want to be able to serve to a stranger.
Which means the checksum is the control
A download nobody has to prove anything to obtain cannot be protected by who fetched it, so it is protected by what arrived. The published SHA-256 is the whole of it, and it is a stronger check than a link only we could have minted: an expiring URL tells you where the bytes came from, and a hash you compute yourself tells you the bytes are the ones we published. Before every deployment serves anyone, each artefact on the server is re-hashed and compared against the manifest, so a truncated upload is caught by us rather than by you.
Passwords we do not have
Sign-in is a one-time link sent to your email. There is no password to remember, and none for us to leak.
Everything is deletable, and the ledger survives it
Your account page hands you a JSON file containing everything we hold about you, and will delete the account outright. Deletion removes your email address and every machine fingerprint and machine name. What stays is the record that a payment produced a licence key, with your name off it, and the seat-change log with your identity removed from it. A security log the person it records can erase is not a security log, and a sales ledger with a hole in it is not compliance.
The reasoning table by table, and how long each thing is kept, is on the privacy page.
Reporting something
If you find a vulnerability, email [email protected]. Tell us what you found and how to reproduce it. We will confirm receipt, keep you updated until it is fixed and we will not threaten you for having looked.