Security

The most secure place for a sensitive document is the one it never leaves.

Content that is never transmitted cannot be intercepted in transit, and content that is never stored in our database cannot be exposed by a breach of our database. The free local app is built on exactly that premise.

Install free Read the FAQ

The local-first posture

No upload means no breach surface for that content.

A proprietary cloud database is a target — it holds every customer's content in one place, reachable over the network. The free local app doesn't have one, because your documents never leave your machine to reach it.

No network calls with your content

The free local app makes no network calls that carry your document content. There is nothing in transit to intercept, because there is no transit.

Plain files, not a proprietary store

Documents are ordinary .md files in a folder you choose. There is no database on our servers holding your content that could be breached, misconfigured, or leaked.

Data residency you already control

Your content resides wherever your disk resides. There is no separate question of which region or vendor's cloud your documents sit in, because they don't sit in one.

Encryption

Encrypted in transit and at rest, when you do sync.

The paid team tier introduces sync so people beyond your machine can collaborate. That path is encrypted end to end.

In transit

Synced content moves over encrypted connections between the client and our sync infrastructure — never in the clear.

At rest

Synced content is encrypted at rest in storage, so a copy of the underlying storage medium does not hand over readable document content.

Identity & access

Verified identity where it matters, self-asserted where it doesn't.

The free local app has no account system, so attribution there is self-asserted — you tell DraftMesh who you are, and it trusts you, because it's your machine. The team tier raises that bar.

Free tier: self-asserted identity

Attribution in the local app comes from your local configuration, not a verified login. That's appropriate for a single person on their own machine — it is never presented as a verified identity.

Team tier: SSO through your identity provider

Single sign-on via SAML or OIDC, through the identity provider your organization already runs. Access is governed centrally, and every attributed action ties back to a verified account.

Audit trail

Append-only, and honest about its edges.

Every change, share, guest session, and refused request is recorded and attributed — agents included, as themselves rather than as an anonymous service account. The record is append-only at the database level, so it cannot be quietly edited even from behind the application.

Writes are recorded

Saves, restores, merges, and conflict resolutions each carry the identity that performed them, human or agent.

Access acts are recorded

Grants, revocations, guest links, guest sessions, and every refused request — with the reason it was refused.

Reading the log is in the log

Viewing the audit log and exporting it are themselves recorded. A copy of the record leaving the system is the most important line in it.

Rows cannot be changed

The table refuses updates, deletes, and truncation. Nothing is pruned, and retention is indefinite.

What the log does not capture

A signed-in member opening a document they already have access to leaves no per-read row, and signing in to the web app is not recorded (pairing a device is). Some high-volume machine events — webhook retries, subscription throttling — are counters rather than rows. The record is append-only but not cryptographically tamper-evident: the guarantee comes from the database refusing to modify rows, not from a signature you could verify independently. The full statement is in the audit & activity guide.

Durability & recovery

Every version is kept. Nothing is silently overwritten.

Durability is structural, not a backup job someone has to remember to run: every save becomes a retained version, so a complete, recoverable history of every document exists by construction.

Complete version history

Every saved version of a document is retained, going back to the first version saved.

One-click rollback

Restore any earlier version without a merge to resolve or a command to run.

Collisions surface, they don't overwrite

If two edits land at once, both are kept and you're told there's a conflict to resolve — DraftMesh never silently discards one in favor of the other.

Report a vulnerability

Found a security issue? Tell us directly.

Email security@draftmesh.com with what you found and, if you can, how to reproduce it. We'll acknowledge your report and work with you on responsible disclosure.

Security & procurement questions

Where is my document content stored?

In the free local app, nowhere but your own disk, as plain .md files. There is no cloud upload and no proprietary database holding your content. On the paid team tier, synced content is encrypted in transit and at rest.

Who can see my documents?

On the free local app, only processes running on your machine. On the team tier, access is granted one document at a time and shown in a single org-wide access review, so the answer is one list rather than an audit of every folder. Every change, share, guest session, and refused request is recorded and attributed to the person or agent who caused it.

What happens to my data if DraftMesh has an outage or shuts down?

Your documents are already plain markdown files on your own disk in the free local app — an outage or a shutdown of DraftMesh the company changes nothing about your ability to open and edit them with any other tool.

How do AI agents affect the security posture?

Agents are treated as first-class, individually attributed principals, not a shared service account — each has its own credential, its own grants, and its own name on everything it does. There is also a floor no grant can lift: no agent credential can accept a suggestion, record an approval, roll back a version, or manage sharing. Deciding is a human act, and DraftMesh enforces that server-side rather than trusting the agent to decline.

How do I report a security vulnerability?

Email security@draftmesh.com with details and, if possible, steps to reproduce. We aim to acknowledge reports promptly and will work with you on responsible disclosure timing.

Start with a posture that has nothing to breach.

The free local app is free forever — no account, no upload, no card. Your markdown never leaves your machine.

Install free See team plans

Free forever, local, no account