Security and privacy overview

Version: 1.12
Effective: 2026-10-08

This overview is for anyone deciding whether to trust Langbyrde with a company's books, and for the accountants who work with them. It explains, in general terms, what is protected, who can read it, what leaves your computer and when, what you control, and how to report a problem. The privacy policy covers the personal information we handle, and the terms of service cover your licence. It describes the version of the app it comes with; where something is not built yet, it says so.

The short version

Your books stay on your computer unless you choose to send them somewhere. We do not run a server that holds them, and there is no account to create.
Sensitive details are encrypted, such as bank account numbers, SINs and tax numbers, with keys kept in your operating system's protected store. We do not have those keys.
Keep the recovery kit safe. In this version it resets a forgotten app-lock passcode, and it is what restoring the company on a new computer will need once that is built. Nobody else holds a copy, so nobody can reset it for you.
The app connects only to the addresses listed below, plus any AI provider address you add yourself, and only when you press a button or turn the connection on. In the Offline setting it starts no connection on its own.
The app has no telemetry, no usage analytics and no third-party tracking software.

What is protected

Sensitive details are encrypted by default: bank, transit and account numbers, SINs, your company's business number, client and vendor tax numbers, and employees' legal names and addresses. The last four digits of an account number stay readable so the app can match a statement to the right account. Your company's own GST/HST number (which contains the business number), its name and address, and client and vendor names and addresses are not encrypted.
The rest of the company file is not encrypted by default. Amounts, dates, categories and invoice lines can be read by anyone who can read the file. If you want the whole file encrypted, turn it on for the company in Settings → Security. A copied file or backup then cannot be read without this computer's keys. Opening it on another computer with your passphrase or recovery kit is not in this version yet, so if this computer's keys are lost, nobody can open that copy, including you. On this computer the company still opens without a passphrase, so whole-file encryption does not protect against someone who is signed in to your computer account.
Most backups in your documents folder are encrypted. Two kinds are not: the backup taken just before a new version changes your company file, and a manual backup you choose to write without encryption. A full export (Reports → Full export) is not encrypted either; it is written to your documents folder as plain files so other tools can open it. In all of these, the sensitive details listed above stay encrypted.
Keys are kept in your operating system's protected store (Keychain on macOS, Credential Manager on Windows). They are not written to a log, a crash report or an export, and they are not sent anywhere. The only file that holds them is a recovery kit you choose to print or save.

Who can read your books

You, and anyone who can use your computer account. Your computer's own sign-in, and the optional app lock, are what keep other people out.
Your cloud drive provider, if you keep your documents folder there, can hold the documents you file in it. It cannot read encrypted backups or the encrypted details inside any backup, but it can read the backups and exports that are not encrypted (see above).
Your accountant, when you send them a CPA package. Sensitive details are left out of a package unless you choose to include them.
Not us. We hold no copy of your books, your documents or your keys.

The app lock

You can set a passcode for this computer (Settings → Security → App lock). Langbyrde then asks for it when it opens and after it has been idle for the time you choose. After several wrong attempts it makes you wait; it never deletes anything because of wrong attempts.

The app lock is a door, not a safe: it keeps someone at your unlocked computer out of the app, but it does not encrypt your files. The passcode itself is not stored. If you forget it, you can open the app again with your recovery kit, and you then set a new passcode or turn the lock off.

The recovery kit

The recovery kit is your company's keys, written out as words (the printed sheet also carries them as a QR code). The app shows it at the end of setting up a new company and asks you to write it down. It is not saved anywhere on the computer. You can print the kit again on this computer, or make a new one, from Settings → Security. Making a new kit changes the key for backups made after that; keep the old sheet with the new one until you no longer need the backups made before the change.

Keep it on paper, somewhere safe and away from this computer and your documents folder. Do not photograph, scan, e-mail or store it in a cloud service: anyone who holds it can read your company's protected details.

What it can do today. In this version the kit does one thing: it resets a forgotten app-lock passcode. Using it to restore a company's protected details on a new computer is not built yet. Keep the kit anyway: that step will need it. The kit is the only key to the encrypted details and backups once this computer's keys are gone: without it, nobody can recover them, including us.

What leaves your computer, and when

Langbyrde connects only to these addresses, plus any AI provider address you add yourself:

licence.langbyrde.app: activating a licence, only when you press Activate. After that the licence is checked on your computer and never online again.
releases.langbyrde.app: checking for a newer version, only when you press Check now (Settings → Updates), and downloading it, only when you press Install. It sends none of your books.
www.bankofcanada.ca, www.ecb.europa.eu and www.federalreserve.gov: exchange rates, fetched when the app needs one, only while "Fetch daily exchange rates" is on and the network setting is Manual or Connected. You can type or import rates instead.
crash.langbyrde.app: one crash report, only if you turned crash reports on, the app crashed, you read the report and you pressed Send.
Your own AI provider: only after you set one up, only in the Connected setting, and only for a task you start.

The app refuses any other address, in every setting. Settings → Privacy & network → Network activity shows the most recent call of each kind and whether it was allowed. Your operating system may make connections of its own (for example to check the app's signature when you first open it); those are not made by Langbyrde.

The three network settings (Settings → Privacy & network):

Offline: the app starts no connection on its own. Buttons you press still work.
Manual (the default): Offline, plus the daily exchange rates if you turn them on.
Connected: Manual, plus the AI providers you set up.

The app works fully offline: importing, categorising, reconciling, invoicing, reports, the CPA package, backups and printing need no connection.

No telemetry

The app does not collect usage data: it does not count how often you open it, what you click or how many records you keep, and it contains no third-party analytics, advertising or tracking software. The only thing it can send about itself is a crash report, which is off by default, shown to you in full and sent only when you press Send. The privacy policy says what a report holds and how long it is kept.

AI, briefly

AI features are off until you set up a provider yourself, with your own key. In this version a provider can suggest reconciliation matches, explain a transaction and draft a memo. Text requests are built from a version of your data with identifying details removed; a receipt image is sent as it is, only to read that receipt and only if your provider settings allow images. The app tries its own on-device model first. A suggestion is not recorded until a person accepts it, and every AI call is listed in Settings → AI activity with its purpose and cost.

Updates

The app does not install an update by itself and does not require you to update. It looks for an update only when you press Check now, and installs one only when you press Install. Before a newer version changes the layout of your company file, the app takes a backup of it first (this backup is not encrypted; see "What is protected").

If support asks for one, Settings → Updates can save a diagnostics file: the app and system versions, recent log lines (cleaned of sensitive details before they are written), the update history, the names of the open companies and the folders your companies use. It contains no passwords, keys or account numbers, and it goes only where you send it.

What you control

Which network setting the app uses, and whether exchange rates, crash reports and AI are on.
Where your documents and backups are kept.
Whether the whole company file is encrypted, and whether the app lock is on.
What goes into a CPA package or an export.

How to check

Open Settings → Privacy & network → Network activity: it shows the last call of each kind and whether it was allowed.
Watch your computer's firewall or network monitor while you use the app.
Choose the Offline setting, disconnect from the internet, and keep working.

Reporting a problem

If you think you have found a security problem in Langbyrde, write to privacy@langbyrde.app. Please include what you saw and how to reproduce it, and do not include real financial data.

How this document is kept accurate

This overview has a version number at the top. It is updated with the release that changes what the app encrypts, how the recovery kit works, which addresses the app can reach or what a crash report contains, and each version is checked against the app it describes before it is published. Inside the app, the privacy policy, the terms of service and this overview open from Settings → Privacy & network without going online.

Version history

1.12 — 2026-10-08 — Corrected against the app: which details are encrypted (and which are not), which backups and exports are not encrypted, that a whole-file-encrypted copy cannot yet be opened on another computer, what the recovery kit does today and why to keep an old kit, the Install button, exchange-rate timing, what Network activity and AI activity show, and what a diagnostics file holds.
1.11 — 2026-10-08 — Shortened to what a buyer or an accountant needs to assess safety: what is protected, who can read it, what leaves the computer and when, what you control and how to report a problem. Added "Who can read your books" and "Reporting a problem". No change to what the app does.
1.0 to 1.10 — 2026-09-28 to 2026-10-08 — First publication and corrections found by checking the text against the app, about exchange rates, updates, whole-file encryption, the recovery kit and the Network activity page. Earlier versions are available on request.

Contact

Questions about security or privacy: privacy@langbyrde.app. Licence questions: support@langbyrde.app.