(01) Each claim links
to the file behind it.
Security
Private by construction, checkable in the source.
SAAR is designed to keep financial data on the user's machine. These are the specific mechanisms, each linked to the file that implements it, and the threats the project wrote down before building.
- Network
The desktop web view blocks every network connection. Its content security policy sets connect-src to none.
src-tauri/tauri.conf.json - Passphrase
A workspace key is derived with Argon2id: 64 MiB of memory, 3 iterations, 1 lane, 32-byte key.
src-tauri/src/security/kdf.rs - Database
Each workspace has its own SQLCipher database, with write-ahead logging and foreign-key checks.
src-tauri/src/db - Documents
Files are stored as AES-256-GCM encrypted blobs, addressed by content hash, written atomically.
src-tauri/src/security/blob_store.rs - Backups
Backup archives are authenticated and encrypted. A wrong passphrase or a flipped bit is rejected.
src-tauri/src/security/backup.rs - Injection
Text hidden in a document cannot instruct the model. Hostile prompts are quarantined and not answered.
src-tauri/src/ai/defense.rs - Logs
A scrubber removes credentials, card numbers and personal identifiers from logs.
src-tauri/src/security/scrubber.rs - Egress audit
The full reliability suite was run inside a disconnected network namespace. Recorded result: zero packets, zero DNS lookups.
Docs/AUDIT/0001-network-egress-denial-audit.md
No independent security audit is claimed here. The project's own egress audit was run on Debian, and the repository states that a source build alone does not verify an installer or a disconnected target machine.
Threat model
Eight threats, written before the code.
The threat model sits next to a registry of ten synthetic test fixtures, so each mitigation can be exercised against a known input.
- TM-01Prompt injection through document textHostile text in an invoice cannot give the model authority. The model never writes to the ledger, and a defence layer intercepts instruction overrides and fence escapes.
- TM-02Malicious PDFsDocuments are parsed by memory-bounded, unprivileged code with page limits, so decompression bombs and malformed files fail safely.
- TM-03Path traversal and ingestion abuseFile names are sanitised and ignored as storage keys. Files are stored by content hash.
- TM-04Data at restThe master key comes from your passphrase through Argon2id. The database and the document blobs are encrypted, and the passphrase is never written to disk.
- TM-05Network egress and telemetryNo runtime network access. The web view policy blocks every connection, and there are no telemetry or updater plugins.
- TM-06Floating-point errorAmounts are integer minor units with checked arithmetic, so totals cannot drift.
- TM-07Worker crashes and out-of-memoryThe OCR and model workers run under supervision with timeouts and recovery.
- TM-08Backup tamperingBackups are authenticated and encrypted. An archive that fails its integrity check is rejected.
Before real data
What you should still do.
Review the threat model and the code before using real financial records in a new environment. Model weights and native sidecars are provided separately, so check their hashes: the expected model SHA-256 is recorded in the Rust runtime source.