How The Product Is Put Together
This page describes what the software actually does. It does not claim a certification we do not hold, and it does not promise that anything is unbreakable.
Signing In To The Desktop App
The app never sees your password.
- The app generates its own signing and encryption keys on first run and keeps them in the operating system's protected storage, tied to your Windows user account on that machine.
- To sign in, the app shows a code. You approve that computer while signed in to your browser, seeing which computer is asking before you approve it.
- The app then redeems the approval once, proving it holds the device key. A replayed redemption is refused.
- Each account may have 1 computer signed in per plan, with up to 3 changes in 30 days. You can remove a computer yourself at any time, and it stops working on its next request.
Sessions And Tokens
- Short-Lived Access
- The app holds a short-lived access token in memory only. A removed computer or a suspended account stops working on the next request.
- Rotating Refresh
- Renewal tokens rotate on every use and each renewal is signed by that computer's own key, so a copied token alone is not enough.
- Reuse Ends The Session
- If a renewal token is ever presented twice, the whole session family is revoked and the computer must be approved again.
Your Content Stays On Your Computer
This is an architectural property, not a policy promise.
- Projects, briefs, prompts, research, drafts and finished articles are stored by the app on your machine.
- Crawling for research runs from your computer and your own IP address, honouring robots.txt.
- SBMM Cloud receives the workflow, your app and engine versions, the state of a run, and a salted hash of the title - not the title, and not the article.
- Your AI provider receives what any prompt you run would send it, under your own account and its terms.
What That Does Not Mean
Anyone who controls a computer can inspect what runs on it. We do not claim that material on your machine is hidden from you, or that a determined person with administrator access to it could be stopped.
The Engine Is Sealed To A Signed-In Computer
The engine ships its agent briefs in a sealed bundle. The key that opens it is not in the installer: SBMM Cloud delivers it to a signed-in computer, encrypted so that only that computer can open it, and the app keeps it in memory rather than writing it to disk. A copied installer without an account opens nothing.
Updates And Releases
- Every published release carries a manifest signed by SBMM Cloud that names the installer's SHA-256.
- The app verifies that signature against keys compiled into the app, then re-checks the downloaded file's checksum before installing, and deletes a file that does not match.
- An app below the supported minimum version is refused a session, and can still download the update it needs.
Payments And The Web Account
- Card Details Never Reach Us
- Payment happens on the payment provider's own page. SBMM Cloud stores the record of a payment - amount, plan, provider reference and invoice - not the card.
- Web Sessions
- The website uses one strictly necessary session cookie, marked HttpOnly and SameSite=Lax and served only over HTTPS in production. Passwords are stored only as argon2id hashes.
- Access Is Checked Server-Side
- Plan, allowance and device status are decided on our servers on every request. A modified desktop app cannot grant itself access it has not been given.
- Administrative Actions Are Audited
- Operator actions on an account are recorded in an append-only audit log with the operator's identity.
Reporting A Problem
If you believe you have found a security issue, please tell us before telling anyone else, and give us a reasonable window to fix it. Our contact route is on the contact page; a dedicated security address will be published there when it is configured.
Read The Detail
What we collect, why, and how long we keep it is set out in the privacy policy.