What we do, and what we have not done yet.

The open gap: code signing

Our applications are not yet signed with a publicly-trusted code-signing certificate. Until they are, Windows would present them as coming from an unknown publisher.

So we are not distributing them. We could open downloads today and tell you to click through the SmartScreen warning. Teaching customers to bypass the exact protection that stops malware is not an acceptable trade for shipping a few weeks earlier.

Acquiring the certificate is the single item blocking releases. When it is in place, every artifact is re-signed, every release page publishes its hash and signature, and downloads open.

What is already true

• No usage tracking. We do not watch what you click, how long you use anything, or what your files contain.
• Error reports only, and only if you turn them on. The one thing worth collecting is what broke, so we can fix it. It is off until you say yes, it says what it is sending, and the software works exactly the same if you decline.
• Local-first. Processing happens on your machine. Network access is a feature, not a requirement to launch.
• It opens without asking permission. Your licence is checked on your own machine against a key inside the application. It does not contact us to let you in, so it still opens if your internet is down, or if we are.
• Encrypted at rest wherever an application stores sensitive records.
• Fail-closed release gate. A build that does not pass does not ship, and there is no override.

How the applications defend themselves

The question most software never answers: once it is running on your machine, what stops somebody else getting at it? These are the specific measures, per application, not a general promise.

• The attack surface is deliberately small. Local first means there is no cloud account holding your data, so there is no account of yours for anyone to breach. A company cannot leak what it never collected.
• Nothing listens to the internet. Where an application needs a network it binds private interfaces only. Beyond Phone Sync has no relay of any kind: no WAN, no UPnP, no STUN or TURN. Beyond Video Calls keeps its GPU worker off the public internet by design.
• Devices pair, they do not trust. Phone Sync uses password authenticated key exchange over TLS 1.3, and stores paired devices encrypted with the operating system's own key store. A device on your network cannot join by asking nicely.
• Sensitive records are encrypted at rest. Beyond Books keeps its ledger in an encrypted database, not a plain file in a documents folder, so a stolen laptop does not hand over your finances.
• Financial history is tamper evident. Every entry is chained to the one before it. Altering a past record breaks the chain and shows, which is what makes the books hold up when somebody asks.
• AI processes run boxed in. Beyond Video Calls executes its recognition and synthesis work in sandboxed processes. Beyond Ollama gives models file access through guardrails and hooks, inside limits you set, rather than handing over the machine.
• No secret ever ships inside a binary. Applications carry the public half of a key and nothing else. There is no embedded password, token or private key to extract, because there is none in there.

How this website is secured

The same standard applies to the site you are reading. Every item here is asserted by our test suite, so the claim fails the build before it can become untrue.

• Strict content security policy. Scripts may load from this origin and nowhere else. No inline script, no plugins, no embedded frames.
• Zero third party requests. No analytics, no font service, no CDN, no tag manager. Nothing you load here reports to anyone.
• HSTS with preload. Browsers refuse to talk to this site over anything but TLS, before the first request is even made.
• Cross origin isolation. The site cannot be framed, embedded, or reached into by another origin.
• Hardware capabilities denied by default. Camera, microphone, location, payment and USB are switched off at the policy level.
• No account, no session, nothing to steal. There is no login on this site yet, so there is no credential here to lose.

How update integrity works

Update manifests are signed with a key kept offline, separate from both the code-signing certificate and the licence-issuing key. Clients verify the manifest signature before downloading anything. Compromise of one key does not compromise the others.

Check our homework

None of this is our own standard invented in private. These are the public references the measures above are built against, so you can read the source rather than take our word:

• Microsoft on code signing, which is why our downloads stay closed until a certificate is in place.
• The OWASP Secure Headers Project, the checklist our response headers are measured against.
• The HSTS preload list, the standard our transport security is configured to qualify for.
• Content Security Policy reference, if you want to read what our policy actually permits.
• Run an independent TLS audit of this site, from a service we do not control.

Reporting a vulnerability

Send findings to office@beyondllcfl.com. We acknowledge receipt, keep you updated while we work, and credit you when it is fixed unless you ask us not to. We will not threaten you for reporting in good faith.

Machine-readable policy: /.well-known/security.txt