Security & Architecture

Security Architecture Brief

Version 0.1.0  ·  March 2026  ·  Prepared for IT Security Review & Procurement Evaluation

Compliance FAQ  ·  Privacy Policy  ·  Terms of Service

1. Architecture Overview

BaringaSoft Pulse is a 100% offline desktop application for caseload management. It is designed for care coordinators, social workers, case managers, and similar professionals who manage caseloads of people with recurring deadlines.

Zero-Network Architecture

This application makes zero HTTP requests. There is no server. There is no cloud.

• No telemetry or analytics
• No crash reporting
• No automatic update checks (updates are manual, user-initiated only)
• No data synchronization
• No third-party API calls
• The only network activity is an optional manual "Check for Updates" action and license activation, both initiated explicitly by the user

Data Flow

All data remains on the user's device at all times. There is no server component, no cloud storage, and no mechanism by which data could leave the device through the application.

Platform Support

• Windows (portable .exe, no installation required)
• Linux (AppImage)
• macOS (dmg)

2. Data Protection

Encryption at Rest

The database key is a cryptographically random 256-bit value generated at initial setup. It is never stored in plaintext on disk.

Key Management

The database encryption key is protected using a key-wrapping pattern:

1. User's password is processed through PBKDF2-SHA256 with 600,000 iterations and a unique 32-byte salt
2. The derived key encrypts (wraps) the database key using AES-256-GCM with a 12-byte IV and authentication tag
3. Only the wrapped (encrypted) key is stored on disk
4. On supported platforms, the wrapped key is further protected by the OS credential store (DPAPI on Windows, Keychain on macOS, libsecret on Linux) via Electron's safeStorage API
5. The raw database key exists in memory only while the application is unlocked
6. On lock or close, the in-memory key is cryptographically zeroed (overwritten with random bytes before nulling)

Authentication

File System Security

• Database file permissions: 0600 (owner read/write only) on Unix
• Process umask set to 0077 during database operations
• Backup directory permissions: 0700 (owner only)
• Backup files: 0600 (owner read/write only)

Backup Security

• Backups are copies of the SQLCipher-encrypted database (encrypted at rest by default)
• SHA-256 integrity hash verified on restore
• Path traversal protection on archive extraction
• Zip bomb protection: 500MB compressed limit, 2GB uncompressed limit
• Atomic write pattern (temp file + fsync + rename) prevents corruption on power loss
• Temporary files cleaned up in finally blocks

3. Application Security

Electron Hardening

BaringaSoft Pulse follows Electron security best practices:

Content Security Policy

Applied at the protocol level (not meta tag), enforced for all renderer content:

No eval(), no remote code loading, no inline scripts in production.

Custom Protocol

The application uses a custom app:// protocol instead of file://, with path traversal guards that validate all requested paths are within the application bundle.

SQL Injection Prevention

• All database queries use parameterized statements with ? placeholders
• Dynamic column identifiers validated as safe positive integers before interpolation
• Database key format validated with strict regex before use in PRAGMA
• Prepared statement cache with LRU eviction for performance

Input Sanitization

• HTML content sanitized with DOMPurify before rendering
• File paths from user input validated against directory traversal
• All IPC (Inter-Process Communication) calls wrapped in try/catch with user-friendly error messages

4. Compliance Positioning

HIPAA (Health Insurance Portability and Accountability Act)

BaringaSoft Pulse is not a covered entity or business associate and does not create, receive, or transmit ePHI over any network. No Business Associate Agreement (BAA) is required. However, for organizations that store PHI locally, Pulse provides safeguards aligned with the HIPAA Security Rule (45 CFR 164.312):

• Access Control (164.312(a)): Password authentication on every launch, auto-lock after inactivity, progressive brute-force lockout
• Encryption (164.312(a)(2)(iv)): AES-256 encryption at rest via SQLCipher
• Integrity (164.312(c)): SHA-256 backup verification, parameterized queries preventing injection
• Audit Controls (164.312(b)): Change tracking and activity timeline for all data modifications

FERPA (Family Educational Rights and Privacy Act)

Because Pulse stores all data locally with zero network transmission, education records never leave the device, eliminating the third-party disclosure risks that FERPA's "reasonable methods" standard is designed to prevent. The encrypted local database, per-launch authentication, and inactivity lock meet FERPA's requirement for technical safeguards on systems storing student records. No vendor data sharing agreement is needed since Pulse never accesses, processes, or stores data on external servers.

42 CFR Part 2 (Substance Use Disorder Records)

Part 2's strict re-disclosure prohibitions make offline architecture ideal for SUD records. Pulse's zero-network design means substance use disorder data cannot be transmitted, intercepted, or re-disclosed electronically. Combined with AES-256 encryption and mandatory authentication, this architecture provides the strongest possible technical barrier against unauthorized disclosures.

State Data Breach Notification Laws

All 50 U.S. states exempt encrypted data from breach notification requirements when the encryption key has not been compromised. Pulse's SQLCipher AES-256 encryption, with the key wrapped by the user's password via PBKDF2 (600,000 iterations) and never stored in plaintext, means that even physical device theft does not constitute a reportable breach under any state statute, provided the password remains uncompromised.

SOC 2

As a locally-installed tool with no cloud component, Pulse falls outside SOC 2's scope (which applies to service organizations processing customer data). However, Pulse supports an organization's own SOC 2 posture by enforcing:

• Confidentiality: Encryption at rest
• Security: Authentication and auto-lock
• Processing Integrity: Audit trails and change tracking

Pulse does not introduce a new third-party data processor into the organization's compliance boundary.

5. Accessibility

BaringaSoft Pulse is designed toward WCAG 2.0 Level AA conformance:

A formal VPAT (Voluntary Product Accessibility Template) is available upon request.

6. Software Bill of Materials (SBOM)

A complete CycloneDX 1.6 SBOM is available for download below or included with the application distribution.

Dependency Summary

Key Components

7. Dependencies & Licensing

License Distribution (Production)

Dual-licensed packages (DOMPurify: MPL-2.0 or Apache-2.0; JSZip: MIT or GPL-3.0) are used under their permissive license option.

8. Frequently Asked Questions

Does the application phone home?
No. The application makes zero network requests during normal operation. The only network activity is a manual "Check for Updates" button and license activation, both user-initiated.

Where is my data stored?
In a single encrypted SQLite database file on your local machine, in the standard application data directory for your operating system.

What happens if my computer is stolen?
The database is encrypted with AES-256. Without the password, the data is unreadable. Under all 50 U.S. state breach notification laws, encrypted data whose key has not been compromised is exempt from breach reporting.

Can my IT department audit the application?
Yes. We provide a CycloneDX SBOM, this security brief, full third-party license documentation, and are available for security questionnaire completion.

Is the application code signed?
Code signing certificates can be configured for Windows (Authenticode) and macOS (Apple Developer ID) distributions. Contact us for signed builds.

Does the application auto-update?
No. Updates are never installed automatically. Users must manually check for updates and choose to install them.

9. Downloads

The following documents are available for IT security reviewers, procurement teams, and compliance officers:

10. Contact

For security questions, SBOM requests, or to schedule a security review:

BaringaSoft LLC
baringasoft@tuta.com

This document is intended for IT security reviewers and procurement teams. It describes the security architecture of BaringaSoft Pulse as of the version and date listed above.