Privacy by Design: AES-256-GCM Encryption for Freelancers
Your data never leaves your machine. I spent two weeks on key management because the first implementation leaked timing information. A researcher in Estonia I'd never met helped me find the second leak. Third time was clean. I think.
Security you can verify
- No cloud. No sync, no telemetry, no third-party servers. There is nothing to breach.
- Encryption at rest. AES-256-GCM encrypts the database. Argon2id derives the key. Your system keychain stores it.
- Open formats. SQLite, JSON, CSV. You can inspect your own data with any tool.
100% Local, Zero Cloud
LockMargin is a desktop application. Your data is stored locally in an encrypted SQLite database on your machine. There is no cloud sync, no remote servers, no third-party data sharing. Ever.
AES-256-GCM Encryption
All sensitive fields (bank accounts, tax IDs, contact information, payment details) are encrypted using AES-256-GCM — the same encryption standard used by banks and government agencies.
How It Works
- Key Derivation: Your master password is used to derive an encryption key using Argon2id.
- Key Storage: The encryption key is stored in Windows Credential Manager — never in the database or files
- Salt Storage: A unique salt is stored in the
encryption_metadatatable (separate from the key) - Authenticated Encryption: AES-GCM provides both confidentiality and integrity — tampered data is detected immediately
What We Don't Do
- ? No cloud storage or sync — your data is your responsibility, not ours
- ? No telemetry or analytics (unless you opt-in) — I don't want your data either
- ? No third-party data sharing — there's nobody to share with
- ? No access to your encryption keys — I literally cannot reset your password
- ? No ability to recover your data if you lose your password — sorry, that's the trade-off for zero-knowledge
Nothing Leaves Your Machine
LockMargin never sends your data, metadata, crash reports or identifiers anywhere. The only network call the app makes is the updater downloading updates; it never uploads anything about you.
Any future feature that sends data anywhere will be off by default: you will see exactly what goes where and for how long before you enable it, and it will use your infrastructure - your storage, your keys - not mine.
Security Audits
LockMargin's security architecture was audited by Maya Thompson, an external Security Researcher and IT auditor. The audit covered:
- Encryption implementation and key management
- SQLite database security
- Windows Credential Manager integration
- Soft delete and data retention policies
Reporting Vulnerabilities
If you discover a security vulnerability in LockMargin, please report it responsibly:
Email: privacy@lockmargin.com
We take all reports seriously and will work with you to understand and resolve the issue. We do not offer bug bounties at this time, but we will credit responsible disclosures (with your permission).
Related Reading
Read our article on what happens to client data when your laptop gets stolen for a real-world perspective on encryption in action.
Best Practices for Users
- Use a strong, unique master password (16+ characters, mixed case, numbers, symbols)
- Enable Windows BitLocker or FileVault for full-disk encryption
- Create regular backups (LockMargin has built-in backup tools)
- Keep LockMargin updated to the latest version
- Lock your computer when stepping away
Compliance
LockMargin is designed to help you comply with:
- GDPR: Data stays on your machine, no third-party processors
- CCPA: You control your data completely
- ABA Model Rules: Suitable for lawyers handling client data (see our article on ABA compliance)
How AES-256-GCM Encryption Protects Freelancer Data
AES-256-GCM isn't marketing jargon. It's the same encryption standard the NSA uses for top-secret documents. LockMargin encrypts every sensitive field — bank accounts, tax IDs, client contacts — before writing to disk.
If someone steals your laptop, pulls the hard drive, and images the SQLite file? They get garbage. Without your Windows password and LockMargin master password, the data is unreadable.
Windows Credential Manager Integration for Zero-Knowledge Security
LockMargin doesn't store your encryption key. It derives it from your master password using Argon2id — then sends it straight to Windows Credential Manager.
We never see your key. We can't reset your password. We can't decrypt your data. Nobody can — except you.
Contact
For security questions, contact privacy@lockmargin.com