Security

The mandatory §21 security documents.

• Threat model — attacker categories, mitigations, out-of-scope surfaces.
• Incident response — GDPR 72-hour clock, severity matrix, decision-maker roles.
• Vulnerability management — intake, SLAs, coordinated disclosure, CRA readiness.

Snapshot

• At rest: SQLCipher AES-256, key in Keychain (iOS) / EncryptedSharedPreferences (Android).
• In transit: TLS 1.2+ enforced by every provider we talk to.
• Local-first by default: data does not leave the device unless the user explicitly enables Cloud sync (Phase 7).
• Secrets: OAuth client secrets injected via --dart-define, never in source; local dev uses a gitignored .env.local.