Privacy and security

This page covers the practical side: where your data physically lives, what is protected by the macOS Keychain, and exactly which network connections the app can make. The formal policy is at Privacy Policy.

Where your data lives

Project and resource data (imported inventories, relationships, findings, generated summaries and documentation, migration assessments, topology drafts) is stored in a local SQLite database in your user library on this Mac. Nothing is uploaded, and there is no account or cloud sync.
Settings and AI token usage statistics are stored in the same local database.
Exported reports are ordinary files saved wherever you choose in the save dialog. The Reports page records their paths locally.

What the Keychain holds

Three kinds of secrets are stored in the macOS Keychain, protected by your system login, and never written to the database or a plain file:

Your AI provider API key.
Your license activation record.
Azure connection secrets (the client secret of each connection profile).

Because the app is signed with a stable Apple Developer ID, macOS normally grants it access to its own Keychain items silently; you should not see Keychain password prompts in everyday use. If secure storage ever becomes unavailable, Settings shows the state explicitly instead of treating you as unlicensed.

What leaves your machine, and when

Two kinds of connection you start yourself, plus the update check:

When	What is sent	To whom
You run an AI feature (summary, documentation, Scout, migration analysis, AI Architect)	The relevant project context for that request, authenticated with your API key	OpenAI or Anthropic, directly, under their API data terms
You run live Azure discovery or Test Connection	Your service principal credentials and resource queries	Microsoft (Azure sign-in and the Azure Resource Manager API)
Once when the app starts, and whenever you press Check for updates in Settings	A request for one static file, `/updates/latest.json`. It carries no license key, no account, no machine identifier, no usage data, and nothing about your projects. Your version number is not sent either: the app downloads the file and compares versions locally. The request is byte for byte the same from every copy of the app.	discovery.zoniteai.com, the Cloud Discovery download site

That is the complete list. The app only ever addresses five hosts: api.openai.com, api.anthropic.com, login.microsoftonline.com, management.azure.com, and discovery.zoniteai.com. All five are hardcoded in the application binary, there is no configurable endpoint, and the app contains no code that can reach any other destination. If your machine routes traffic through an HTTP proxy, requests traverse it exactly as they would for any other application.

No telemetry, no analytics, no crash reporter.
The update check is an anonymous download of a public file. Our web host logs it the way any web server logs a file request: an IP address, a timestamp, and the file requested. We do not tie it to a license or a customer, because nothing in the request says who you are.
If the check fails, is blocked, or is offline, the app carries on and says nothing. You can also ignore updates entirely and install them yourself from the website.
License activation is checked locally on your machine; there is no activation server.
File parsing, classification, relationship mapping, findings, topology, migration assessment, and exports all run offline.

How updates are trusted

Every update is signed twice before it is offered to you. Apple's Developer ID signature and notarization ticket are the same ones on the installer you first downloaded, and on top of that the update archive carries a separate signature from a key held offline. The public half of that key is compiled into the app you are running, and the app refuses to install anything that does not verify against it. A tampered file on the network, or on our web host, is rejected before it is unpacked.

The download and the signature check both happen in the app's native process, not in the embedded browser view, which continues to have no network access of its own.

Working with client data

Because everything is local, the data-handling story for your clients is short: their inventory is processed on your machine, and the only third party that can see any of it is the AI provider you choose to use, when you choose to use it. If an engagement forbids third-party AI processing, skip the AI features for that project; the deterministic pipeline still produces the resource inventory, findings, topology, and migration assessment.

Removing data

Delete a project from the Projects page to remove all of its data from the database.
Remove your API key with the Remove key button in Settings, and your license with Remove from this device.
Uninstalling the app and deleting its data folder from your user library removes everything else. Keychain items can be removed with the Keychain Access app.