Version of
Security and trust
Security depends on the route actually used, the installation and the people operating it. This page separates Perennos Tempo's reviewed design from controls that still need adoption or verification. A local-first design is a starting point, not a guarantee against loss or misuse.
Local-first, private-by-rule
Perennos Tempo is designed to use the engines on your own machines. The reviewed default profile keeps hosted spending at zero; using a hosted provider requires explicit configuration. Missing or unknown privacy labels are treated as private in the reviewed routing rules. A public label does not remove personal information from the request.
A private route must not silently fall back to an outside service. Connecting a service means reviewing the information it receives, where it processes it, its retention and training terms, and the authority for that transfer. Software screening can miss sensitive content, so minimisation and human judgment remain necessary.
The website is a separate system hosted through Cloudflare. A website visit is not a local-only transaction. See Privacy for that data flow.
Evidence and current limits
| Control or record | What the evidence supports | What it does not establish |
|---|---|---|
| Default local routing and privacy rules | Rules and implementation in the reviewed product source | That every client installation has the same configuration or passed a live isolation test |
| Hash-chained receipts | A way to check continuity against a trusted reference | A signing identity, complete event capture or truth of the recorded event |
| Signed receipt-reference batches | Tested source changes for sealing a case and its normalised receipt references with an existing signing identity | Live deployment, historical authorship of each job, or a signature over every report paragraph |
| Conformance report export | Tested source changes that assemble fixed evidence records, identify gaps and preserve supporting hashes | Legal compliance, the accuracy of supplied business facts or an authorised human sign-off |
At the 10 November 2026 review, the signed-batch, exporter and requirement-map changes remain In progress, with their review requests open and unmerged. Test evidence concerns those source versions. Actual adoption, key custody, installation permissions and real-case acceptance must be verified separately. No website badge should imply otherwise.
With a signed batch, a verifier needs a public-key reference authenticated through a separate trusted route. Accepting a key supplied only alongside the same untrusted file does not establish the issuer's identity. A batch signature authenticates its defined payload; it does not make an unsigned report trustworthy by association.
Working safeguards
For a client deployment, the security schedule must identify access permissions, credential custody, approved connections, update responsibilities, backups and recovery, retention, incident contacts and the checks required before a release. Access should be limited to the task and removed when no longer needed. We do not publish sensitive installation details in a public trust page.
We do not represent this page as an independent penetration test, ISO certification, SOC report or guarantee of uninterrupted service. Ask for the dated evidence relevant to your proposed configuration. Where a check has not been performed, the record must say Untested.
Report a vulnerability
Email talktome@perennos.com with “Security report” in the subject. Include the affected address or version, a concise description, minimal reproduction steps and the potential impact. Do not include passwords, access keys, unrelated personal data or a large exploit archive. Ask for an appropriate transfer method if sensitive evidence is necessary; we do not publish a public encryption key on this page.
Stop after the minimum evidence needed. Do not access other people's records, change or remove data, disrupt service, use social engineering, demand payment or test a third-party system without its owner's permission. If you encounter personal information, stop and tell us how to locate the issue without copying more of it.
We welcome good-faith reports and will agree a proportionate investigation and disclosure plan. No bounty, fixed response-time guarantee or blanket immunity from third-party law is offered by this page. Intrusive testing requires a separate, written scope. If a deadline or serious exposure makes coordination urgent, state that clearly in the subject and message.
security.txt
Our machine-readable disclosure file is at https://perennos.com/.well-known/security.txt, in the RFC 9116 format. It names the contact above and expires on 8 February 2027; it must be renewed before then. The file does not offer a bounty, an encryption key or a response-time guarantee.
For personal-data concerns, see Privacy.