Security &
Privacy
LAST_AUDIT: 2026-07-17
01. Local-First Architecture
Assertion: Your source code never leaves your machine unless you explicitly connect a cloud LLM (BYOK).
SourcePrep runs entirely on localhost. Indexes, embeddings, and configuration are stored locally in ~/.local/share/sourceprep (or in-project via embedded mode). The OSS daemon and CLI make no network calls — the only way code context ever leaves your machine is a cloud LLM you explicitly configure (BYOK). Pro and Teams licenses activated via Lemon Squeezy re-validate the license key with api.lemonsqueezy.com every 7 days (30-day offline grace before downgrade); no source code, index data, or usage stats are ever sent.
02. Product Telemetry & Analytics
These guarantees describe the SourcePrep desktop app and the local prep daemon, which ship no telemetry, crash reporting, or behavioral tracking. This marketing website uses Plausible — a cookieless, EU-hosted, privacy-friendly analytics service that records only anonymous, aggregate page views. No cookies, no cross-site tracking, no personal profiles, and no consent banner required.
03. Network Isolation
The SourcePrep daemon binds to 127.0.0.1:8400 by default. Remote access requires explicit configuration.
04. LLM & Embedding Usage
SourcePrep's structural code graph (imports, calls, symbol graphs) and semantic search (via built-in ONNX embeddings) work entirely locally without any external LLM. For deep reasoning and trace enrichment, you may bring your own cloud API keys (BYOK) or connect Ollama locally. We never proxy calls, never store keys, and never mark up token costs.
05. Offline Verification
License infrastructure will exist only in the Pro installer. The open-source version ships with none — no keys, no activation, nothing that could phone home. Pro activation will be a single online key exchange; after that, SourcePrep will store a signed Ed25519 license file locally and verify it offline — no periodic phone-home, no subscription heartbeat. (Pro is coming soon; the current license crypto is being replaced before launch.)
06. Supply Chain Security
Pro installers will be code-signed and notarized, with SHA-256 checksums accompanying every release. The open-source version will be built from public source under Apache 2.0 — you can audit exactly what runs.
> <compare against the SHA-256 on the release page>
Vulnerability Reporting
If you discover a security vulnerability, please report it responsibly. We acknowledge reports within 5 business days.
[email protected]07. Bug Reports & Debug Logs
SourcePrep includes a one-click bug report feature (accessible from the dashboard log console). When you submit a report, here's exactly what's included — and what's not:
Included in Reports
- ✓ App version & OS info
- ✓ Index stats (file count, chunk count)
- ✓ Pipeline stage & build status
- ✓ Error messages & stack traces
- ✓ Your description & steps to reproduce
Never Included
- X Source code or file contents
- X Index embeddings or vectors
- X File paths beyond project root name
- X LLM prompts or responses
- X License keys or credentials
Bug reports are previewed before submission — you can review every field. If you're offline or prefer not to send data, the report is saved as a local JSON file you can inspect and email manually to [email protected].
Privacy Policy
LAST_UPDATED: 2026-07-17
08. Data Inventory
Executive Summary: SourcePrep is a local-first desktop application. Your source code never leaves your machine unless you explicitly connect a cloud LLM (BYOK). The open-source version collects nothing — unless you choose to send a bug report or support request. Pro adds one thing: a one-time license activation. Future hosted tiers (Teams, Enterprise) will have service-specific data terms.
Not Collected
- X Source Code & Files
- X Index Data / Metadata*
- X Telemetry / Usage Stats
- X AI Prompts / Responses
Collected
- ✓ License Key (Pro activation)
- ✓ Machine ID (Pro hardware lock)
- ✓ Email (Support / billing)
* Future hosted Teams sync will store embeddings + graph metadata — never source.
The license key and machine ID are Pro only — the open-source version collects nothing unless you choose to send a bug report or support request. Bug reports and support emails you submit are delivered through Resend, a US-based email subprocessor, under a data-processing agreement with Standard Contractual Clauses. Resend receives your message and reply-to email plus the diagnostics report attached to your submission.
09. Payments
The open-source version involves no payment and no account. Payments for paid tiers will be processed by Lemon Squeezy (planned Merchant of Record). Magnetic Anomaly LLC never stores credit card numbers, banking information, or tax IDs.
10. Data Retention
| Data Type | Retention Period |
|---|---|
| License Records (Pro) | Lifetime of active license + 2 years |
| Support Tickets | 2 years from closure |
| Hosted backend logs (Teams/Enterprise, coming soon) | 30 days (rolling) |
Compliance Officer
For data deletion requests or GDPR/CCPA inquiries:
[email protected]