Security · first pillar

Security is the product — not a footer link.

Local-first. Mesh-bound. Host-honest. We design for a Family Office that owns its hardware and network — not a rented control plane as the only home for family data.

Host-only seed Explicit Suite Get Auth + edge locks Threat model written

Privacy posture Network layers Minimum setup

Model

Reduce what is installed. Reduce what is listening. Reduce what is public. Make every expansion an operator decision — Suite Get, peer keys, published doors — never a silent warehouse or a surprise cloud.

Controls

Six hard defaults

Host-only product surface

Only The Briefcase.app by default. No pre-stamped junk. Suite Installer Get is the sole path that adds Console/Native to the product folder.

Bind law

Private organs listen on 127.0.0.1 + WireGuard IP. Not open on guest Wi‑Fi. Locks = authentication + network edge — not “security by obscurity.”

Tunnel for travel

WireGuard mesh (GL.iNet-friendly). Encrypted path to home compute/NAS. Optional for desk-only operators.

Identity you hold

Family SSO, passkeys, optional Greet Native biometrics. Public sign-in only for doors you publish on a gated edge.

Signed install path

.pkg / .dmg packages, product folder stamp, prune on reinstall. Checksums when you distribute builds.

Marketing ≠ product

thebriefcase.app is brochure + Suite sites + guides. It does not host your vault. See privacy.

Threat orientation

What we optimize against

House Wi‑Fi clients scanning open model / forge ports
“Install everything” suite dumps bloating the product folder
Blurring marketing access logs with family product data
Depending on a single SaaS as the only control plane for family life
Accidental 0.0.0.0 binds pretending to be “just LAN”

What we do not claim: invulnerability, anonymity networks, or that misconfiguration is impossible. Operators still own firewall discipline. We make the secure path the default and the documented path.

Operator checklist

Prove the posture on your desk

Install host only — folder should not look like a warehouse.
Suite Get one console; confirm nothing else appeared.
From a guest SSID phone, private organ ports should fail. That failure is success.
If you travel: WireGuard handshake first, doors second. WG guide.
If you publish: only gated TLS doors, never raw compute ports. Layers.

Privacy posture → Get host Guides