Security

Chargd's security model starts from a simple fact: your data never leaves your device, so most of the usual risks (server breaches, database leaks, account takeovers) simply don't apply. Here's what that means in practice, and what we do to protect the parts that remain.

Local storage, restrictive permissions

Your invoices, clients, and financial records live in a local database on your Mac, with file permissions restricted to your own user account. Nothing is uploaded, synced, or transmitted by the app during normal use.

Licence keys stay in the Keychain

Your Pro licence status is stored in the macOS Keychain, the same secure, OS-level storage Apple uses for passwords and certificates, not in a plain settings file. A tamper-evident signature protects it: if the stored licence entry is altered outside the app, Chargd detects the mismatch and safely falls back to the Free tier rather than crashing or silently accepting a forged licence.

Input handling

Every search and list query in the app (clients, invoices, items, payments) uses parameterised queries rather than hand-built SQL strings, closing off the most common way an application can be tricked into running unintended database commands.

File paths you provide, for a backup location, a logo upload, or a PDF save destination, are validated before use, to guard against path traversal and similar tricks that could otherwise let a crafted file path read or write somewhere it shouldn't.

Database integrity checks

On every launch, Chargd checks the database for corruption and confirms it's a schema version the running app understands before touching it. If a problem is detected, the app stops and shows a clear recovery path (restore from your last backup) rather than risking further damage to your data.

Logs don't contain your data

Sensitive values (bank details, licence keys, email addresses, file paths containing your username) are redacted before anything is written to a log or error message, on the rare occasions the app needs to log one at all.

No analytics, no tracking

Chargd doesn't include any analytics or telemetry SDK. Crash reporting is opt-in and off by default; when it ships, it will send only the error type, stack trace, and app/OS version, never your business data.

Signed and notarized releases

Every release is code-signed and notarized with Apple before distribution, and the app checks for updates without installing anything automatically. You approve every update, and you can see the download size before you do.

Payment security

We never see or store your card details. Purchases are handled entirely by Lemon Squeezy, our payment processor and merchant of record, who maintain their own PCI-compliant payment infrastructure.

Reporting a security issue

If you believe you've found a security vulnerability in Chargd, please email support@chargd.pro with details. We take these reports seriously and will respond as quickly as we can.