Security Architecture

How Broomed keeps your files private, cryptographically verifies software licenses, and secures AI inference.

Non-Custodial Files

Index databases and embedding vectors remain exclusively in your user profile directory. No cloud server ever receives your file contents.

Offline Cryptography

License tokens are digitally signed with RS256/SHA-256 signatures. The app verifies tokens locally using our public key.

Ephemeral AI Gateway

Online inference calls are routed through memory-only pipelines with strict rate-limiting, size constraints, and zero prompt storage.

1. Local Indexing & SQLite Storage

Broomed builds semantic indices on your local disk using embedded SQLite and local vector embeddings. Because all chunking, embedding generation, and tokenization occur within the desktop process, index operations require zero outbound network calls.

2. Cryptographic Entitlement Protocol

To eliminate the need for an always-on internet connection or invasive telemetry, Broomed uses asymmetric JSON Web Tokens (JWT) for licensing:

// Entitlement JWT Structure (RS256) { "sub": "user_2x...", "did": "device_8k...", "sid": "sub_4m...", "status": "active", "ent": true, "exp": 1724800000 }

Desktop clients download our public key from /.well-known/broomed-pubkey and verify token integrity locally with standard cryptographic math.

3. AI Gateway Security & Size Enforcement

When a user elects to use cloud-assisted reasoning, the request passes through our authenticated gateway:

Bearer Entitlement Check: Every AI request must present a valid, unexpired entitlement token.
Payload Bounds: Text prompts are strictly capped at 100 KB; vision payloads are restricted to 5 MB.
Token Bucket Throttling: Multi-tiered rate limiters guard against abuse per IP, device, and subscription.
Zero Data Ingestion: Requests are processed in transient memory streams and immediately forwarded to LLM endpoints.

4. Edge Database & Authentication Security

Our web companion database is hosted on Cloudflare D1 with strict isolation. Session authentication is managed by Better Auth with secure, encrypted cookies and token rotations. Webhooks, activations, and license issuances execute transactionally within Cloudflare's serverless edge infrastructure.

Responsible Disclosure

If you discover a potential vulnerability in our infrastructure or desktop application, please report it confidentially to security@broomed.app. We acknowledge and investigate all reports promptly.