Security overview
How Orbelle Desktop handles project data, network connections, encryption, sign-in and updates. Use it as a starting point for your own security assessment, and contact info@orbelle.net for anything it doesn’t answer.
How the app is built
Orbelle Desktop is an installed app for macOS and Windows, built with Tauri 2: a native layer written in Rust, with the interface drawn by the operating system’s own web view (WebKit on macOS, Microsoft Edge WebView2 on Windows). It is not a browser extension and does not run a local web server.
The interface has no network access of its own. Its content security policy lets it talk only to the native layer, and the native layer decides which hosts can be reached and how.
Where project data lives
Your organisation chooses one of three places. Project data is never sent to Orbelle.
- Locally only. In the app’s own data folder in the user’s profile (Application Support on macOS, AppData on Windows).
- Your own PostgreSQL database, on your network and accessed through your VPN. Each person signs in with their own database account.
- SharePoint lists on your own Microsoft 365 site, with each user signing in with their Microsoft work account.
With a shared register, a local copy is kept so work can carry on offline; changes are sent when the connection returns.
Network connections
These are the only hosts the app contacts. There is no analytics, telemetry or crash reporting.
| Host | Purpose | When |
|---|---|---|
| api.forecast.it | Reads projects, phases, tasks and team members from Forecast. Fixed to HTTP GET in the native code, so the app can’t change anything in Forecast. | Only if a Forecast API key is entered |
| Your Jira site | Jira Cloud or Jira Data Center, at the address your organisation enters. Reads issues, releases and epics for linked projects. The only change it can make is creating a new issue when a person asks from a record; it can’t edit, move, comment on or delete anything in Jira. These limits are enforced in the native code. | Only if a Jira token is entered |
| login.microsoftonline.com | Microsoft sign-in (Entra ID, authorisation code flow with PKCE, no client secret), in the system browser. | Only with the SharePoint register |
| graph.microsoft.com | Reads and writes the register’s SharePoint lists with delegated permissions. | Only with the SharePoint register |
| Your PostgreSQL server | The shared database, over TLS with the server certificate checked. | Only with the shared database |
| Orbelle update server | Checks for and downloads signed updates (hosted on Cloudflare). | At start and every six hours |
Encryption
- At rest, locally: the register, sync records and daily backups are encrypted with AES-256-GCM, with a new random initialisation vector for every save. On macOS the key is built inside the app from the Mac’s hardware ID and is never stored. On Windows it is held in Windows Credential Manager, protected by the person’s Windows sign-in. A copy of the data folder can’t be read on another computer.
- Backup files: can be protected with a password, using AES-256-GCM with a key derived by PBKDF2-SHA256 (600,000 rounds). The password is never stored.
- In transit: HTTPS to Forecast, Jira, Microsoft and the update server; TLS to your database.
- Exports: Word and Excel reports are ordinary files once saved. Keep FileVault or BitLocker turned on.
Secrets
- The Forecast API key is typed in each session and held in memory only. It is never written to disk, backups, exports or the shared register.
- The Jira API token (Jira Cloud) or personal access token (Data Center) is typed in each session and held in memory only, like the Forecast key.
- The database password is asked for when the app opens and held in memory only.
- Microsoft sign-in tokens are held in memory only.
Access and accountability
- Shared database: one account per person. Every change records who made it and when, and earlier versions are kept in a history table. Staff accounts can’t restore deletions; your database administrator can. Removing more than 20 items at once needs confirmation.
- SharePoint: delegated Graph permissions
Sites.ReadWrite.AllandUser.Read, plusSites.Manage.Allfor the site owner who creates the lists. Changes are version-checked, so nobody overwrites someone else’s change without seeing it. - App lock: optional. Hides the register after a set idle time, and unlocks with Touch ID or the Mac password, or Windows Hello. The operating system checks the sign-in; the app never sees it.
Updates and integrity
- Updates are signed, and the app installs an update only if its signature matches Orbelle’s update key.
- Licence keys are signed (Ed25519) and checked in the native code, offline. A licence can be tied to one computer or cover a whole organisation. When it ends, the app becomes read-only.
- Publisher code signing for the macOS and Windows installers is being arranged. Until then, your IT team may need to allow the installer.
What the app doesn’t do
- It doesn’t install background services or start when the computer starts.
- It doesn’t change system settings or other apps, and uses no system-wide keyboard hooks.
- It doesn’t write outside its own data folder, except where a person chooses in a Save dialog.
Hosted edition
A hosted edition that runs in the browser is in development. It will use sign-in through your organisation’s Microsoft accounts and multi-factor authentication. This page will be updated when it is available.
Last updated 25 October 2026.