Data & Security

Electron security boundary

The documented architecture uses nodeIntegration: false and contextIsolation: true. Filesystem operations stay in the Electron main process and are exposed through a narrow preload bridge.

File persistence

The current .cgtdesk format is JSON-based. Writes are designed to be atomic: serialize, verify, write a temporary file, rename it into place and create a backup from the same payload.

Encryption status

Encryption and stronger database-backed migration controls are identified as future production work. Current releases should not be represented as providing encrypted entity-file storage unless a later implementation is verified.

Recommended controls

• Use full-disk encryption where appropriate.
• Protect working files, backups and exported workpapers.
• Keep the operating system and application current.
• Do not publicly share live entity files for support.