In short (not part of the Security Overview)
- Your business data stays on your PC; we hold no copy, and the License Check carries none of it.
- Databases and Backups are encrypted; imported-file copies, attachments, exports and logs are not.
- Your License Key opens your Backups by default. For Backups only you can open, set a Backup Password and choose that only it opens them.
- We sign in only when you ask, with a time-limited Support Token; our changes are logged as "(vendor access)", viewing is not.
- No SOC 2 or ISO certification, outside penetration test or code-signed installers yet.
- Report security problems to support@livingroomlogistics.com. Your PC, network and Backups are your responsibility (section 16).
LivingRoom Security Overview Draft 2 of 2026-10-25 - not yet in effect
This Security Overview is published by Point of the Mountain Software LLC, a Utah limited liability company ("Company", "we", "us", "our"), for its LivingRoom software ("Software"). It explains how the Software protects Customer Data, how we protect the data we hold and run our own services, and what we ask of you. Words with capital letters have the meaning given in our End User License Agreement ("EULA") and our Beta, Coming Soon and AI Assistant Terms ("Beta and AI Terms").
1. About this overview
1.1 This overview summarises version 2.0 of the Software and our practices at the date above.
1.2 It is a description, not a contract or a warranty; the EULA, our Terms of Service and, where one applies, our Data Processing Addendum prevail over it.
1.3 No software or service is completely secure.
1.4 Beta and Coming Soon Features are covered by our Beta and AI Terms. A Coming Soon Feature sends nothing until switched on; when we switch on one that sends data off your PC, we will update this overview.
2. Where your data is
2.1 On your PC. Customer Data stays in your Installation (your PC, or one office server PC on your own network); we run no cloud database for it and receive no copy.
2.2 No telemetry: no usage analytics, crash reporting, advertising or other tracking.
2.3 What leaves your PC. The License Check (at start-up and about every 24 hours) sends our License Server the license ID, License Key, Machine ID and a one-time number, never Customer Data; your network (IP) address reaches our server with the connection (EULA section 4.3). A Trial Key, and a License Key we issue by hand that is not marked for online checks, is never checked online. Anything else leaves only when you or an Admin act or turn a feature on (see our Privacy Policy). Spelling is checked on the PC, by Windows' own spellchecker or an English (US) dictionary that ships with the Software; no dictionary is downloaded [not yet released].
2.4 One PC. A PC that is not an office server accepts connections only from itself, plus encrypted phone-page connections if an Admin turns on phone access (section 5.4).
2.5 The AI Assistant is a Coming Soon Feature in the current release: it is not available and is not part of what any Plan pays for. When we publish its model on our own download host (Cloudflare R2, under our account), it becomes a Beta Feature included in every Plan [to be confirmed]. It runs its AI Model on the PC offline; questions and answers do not leave the PC (Beta and AI Terms, section C).
3. Encryption on your PC
3.1 Databases. Each database is encrypted on disk with AES-256 and its own random 256-bit key.
3.2 Keys are kept in a key file Windows protects (DPAPI) for the Windows user that runs the Software, are not derived from your License Key and are never sent to us; a Backup carries what it needs to restore its databases, inside its own encryption (section 4.2).
3.3 Recovery Code. A 25-character code, shown only to an Admin who re-enters their password on the PC that holds the data, unlocks the keys on a new PC or Windows profile.
3.4 Passwords. User passwords are stored only as one-way hashes (bcrypt); passwords and API keys saved for connections are stored encrypted and are not sent to us.
3.5 Not encrypted (EULA section 8.5): copies of imported files (which can contain buyers' names and addresses), attachments, logos, exports, printouts, e-mailed reports, support files, logs, the Software's own browser storage (which holds the signed-in user's account details) and, once available, the AI Model file. Nor does encryption stop anyone, or any malicious program, using the PC as the Windows user who runs the Software; deleted data can stay readable until overwritten. We recommend drive encryption (BitLocker or Device Encryption) on every PC holding Customer Data.
3.6 Lost keys. If the Windows keys, the Recovery Code and every Backup you can open are all lost, no one, including us, can recover Customer Data.
4. Backups
4.1 When: about every 24 hours while the Software runs (with an installed License Key), before an Update changes your data, before every restore, and on request (EULA section 8.3).
4.2 Encryption. Each Backup is encrypted as a whole (AES-256-GCM, its own random key); only its header is readable: when, how and by which version it was made, whether it needs an extra password, a short License Key fingerprint, and short identifiers made from the names of the Company Files inside.
4.3 What opens a Backup: by default your License Key and, if one is set, your Backup Password, each on its own. Once a Backup Password is set, an Admin can choose that new Backups open with it only; earlier Backups keep opening with the License Key. A Backup made by hand with an extra password opens with your License Key together with that password. If a Backup Password was set when the Backup was made, it also opens with the Backup Password alone. Once an Admin has chosen that only the Backup Password opens new Backups, the extra password adds nothing (EULA section 8.4).
4.4 What this means. We never receive your Backups, but we keep (or can re-create) every License Key, so anyone with a default Backup and your License Key - including us, if we had the file - could open it. For Backups only you can open, set a Backup Password and choose that only it opens them. A Backup that needs a Backup Password or extra password you have lost cannot be opened by anyone, including us; a lost License Key we can send you again.
4.5 Off-site copies. By default Backups are saved in the Backups folder on the same PC (in the Software's data folder); an Admin can also set an off-site copy folder (for example a cloud-synced folder or a USB drive), which needs a Backup Password. Only the encrypted Backup files are copied.
5. Data in transit
5.1 Online services. The License Check and connections to online services use HTTPS with certificate checks; a License Check is never sent to another computer without HTTPS.
5.2 E-mail goes only through the mail server you set up and only encrypted, after the mail server's certificate and host name are verified (against the certificates Windows trusts); if they cannot be, nothing is sent [not yet released].
5.3 Office Server Mode. PCs talk to the office server over TLS 1.2 or later and, once paired, accept only its certificate, whose private key never leaves the server PC or goes into a Backup. Its port is opened in Windows Firewall for private networks only.
5.4 Phones. Phone access is off until an Admin turns it on; phones then use TLS with the PC's own certificate (check its fingerprint against Settings at the first warning). Each user signs in with their own password, phone pages only read data, and the support account can never sign in on a phone.
6. Access control
6.1 User Accounts. Each Authorized User has their own User Account; passwords need at least 8 characters. There is no two-step sign-in (multi-factor authentication) for User Accounts yet.
6.2 Roles. Each user has a role with its own permissions; Admins can limit a user to chosen Company Files.
6.3 The support account has the Super User role, which cannot be given to any other user. It has no password in the installed Software and opens only with a Support Token (section 8).
6.4 Failed sign-ins. After 10 failures within 15 minutes for one user name or from one network address, further attempts are refused for a while; failures and lockouts are logged.
6.5 Sessions end after 8 hours without activity by default (an Admin can choose 5 minutes to 7 days).
6.6 Seats count people signed in at once, not devices (EULA section 7.1).
6.7 Keys for outside access. Reporting API and web companion keys read data without a Seat; only Admins create them. Reporting API keys are read-only, shown once and stored only as a one-way hash. Revoke unused keys (EULA section 7.3).
7. The activity log
7.1 The log records who did what and when: sign-ins (failed ones and lockouts too) and changes to records, prices, stock, settings, users, Backups, restores and licensing. Viewing and searching are not recorded.
7.2 Admins can view it; no one can delete single entries, and nothing is deleted automatically. Only these empty it, each leaving a record: an Admin emptying a Company File's data (that file's log) or resetting the Installation, and our support, in a Support Session, clearing the log or permanently deleting an archived Company File (with its log), which we do only at your Admin's written request [to be confirmed]. A restored Backup brings back its own log; the Backup made just before the restore keeps the later entries.
7.3 The log is kept in the encrypted databases but is not designed to resist someone who controls the PC as the Windows user that runs the Software.
8. Support Sessions (vendor access)
8.1 Only when you ask: in a Support Session you arrange, while you share your screen or give us remote access, and only on the PC that holds the data (EULA section 10). You never give us your password.
8.2 The Support Token we sign for your License Key works only where that key is installed, for 4 hours unless we agree longer (never more than 7 days); a Support Session never outlasts it. Signing out does not cancel it: it can be reused until it expires, so ask us for the shortest time you need.
8.3 You can see it: the top of the screen shows "Vendor ยท expires" and the end time; sign it out to end it. It uses a Seat and can sign in even when every Seat is taken. Each Support Session's start and end are recorded on your PC (kept 3 years, at most the 500 newest, also through a restore, a reset or a clear of the activity log); when one of your Admins next signs in, the Software shows when each Support Session started and how long it lasted; the License page lists them [not yet released].
8.4 What we can and cannot do. In a Support Session we have Super User rights across your Installation: everything an Admin can do, and some actions only the support account has - restoring Backups (also in Read-Only Mode, and Backups made under another License Key), issuing Backup restore codes, permanently deleting User Accounts, creating roles or changing what a role may do, permanently deleting an archived Company File and clearing the activity log. We permanently delete User Accounts or an archived Company File, create or change roles, clear the activity log, delete other Customer Data or reset the Installation only at your Admin's written request [to be confirmed]. We cannot change or reset any password, create users or password recovery keys, see or replace your Recovery Code, create Reporting API or web companion keys, change your Subscription's Plan, or accept the EULA (or a new version of it) or the AI Assistant consent for you [not yet released] (EULA section 10.3).
8.5 What is recorded. The support sign-in and every change made in a Support Session are recorded in the activity log, marked "(vendor access)". Viewing and searching are not recorded.
8.6 Our side. We keep a record of each Support Token we issue: when, for which License Key and until when [not yet available]. Only the Company's owner can issue Support Tokens [to be confirmed]. We use what we see only to help you, and copy no Customer Data unless you ask (EULA section 10.5).
9. License Keys and the License Server
9.1 Signed keys. Every License Key is digitally signed by us; the Software can check a key but not make one, refuses a changed key, and uses another license server only if a file signed by us names it.
9.2 The check runs over HTTPS (section 5.1) and sends only what section 2.3 lists. The answer can say whether the key is valid, deliver a renewed key, or carry Subscription notices [not yet available]. A License Check cannot read or delete Customer Data. A renewed License Key it delivers with fewer Company Files archives the ones over the limit (EULA section 6.3); nothing is deleted.
9.3 No answer. If the Software cannot reach our License Server, it keeps working for up to 30 days after the last successful License Check (a reminder appears after 7 days), unless your License Key expires first: a Monthly key is valid for the paid month plus 5 days, then a 14-day Grace Period. The same applies if its answer cannot be read. So an outage that spans a monthly renewal can make the Software read-only after as little as about 19 days. It then switches to Read-Only Mode until a License Check succeeds; nothing is deleted (Terms of Service section 6.7; EULA sections 4.5 and 5.5).
9.4 Hosting. The License Server runs on Cloudflare Workers; its administrative functions need a secret only we hold.
10. The Reseller Portal
Our hosted Reseller Portal [not yet available] requires authenticator two-step sign-in for every account and strong passwords, stored only as salted, slow one-way hashes; it stores no License Keys, signing keys or payment details (Paddle takes payments).
11. Our own operations
11.1 We are a small company; our owner is responsible for security and runs the program this overview summarises.
11.2 What we hold. License Data (see our Privacy Policy and Subprocessor List), on our License Server and Reseller Portal (hosted by Cloudflare), in our e-mail account and on our own PC. Our License Server also keeps a Trial requester's e-mail address, name, business name and Trial end date (for the trial-ending e-mail) and a record of each automatic-renewal consent (no network address); it and the Reseller Portal delete each record automatically, in daily batches, once its Privacy Policy period has ended [not yet released]. Paddle, our online reseller and Merchant of Record, handles card and bank details; we never receive them.
11.3 Secrets. Our signing keys and services' secrets are kept only on our own PC or as secrets in our hosting account, never in the installer or our source code (section 12.2).
11.4 Our accounts that run our services or hold License Data use multi-factor authentication [to be confirmed].
11.5 Our PC, where we issue License Keys and keep records, uses full-disk encryption, a screen lock and current security updates [to be confirmed].
11.6 People. Only our owner has access to our systems today; anyone we add will get only the access their work needs and be bound to confidentiality [to be confirmed].
11.7 If a signing key is exposed, we would replace it and ship the new one in an Update [to be confirmed].
12. How we build the Software
12.1 Tests. Every release must pass our full automated tests and installation checks on a clean copy of Windows.
12.2 No secrets in installers: the build fails if a secret file or key-shaped text would be included.
12.3 Components. Exact versions are pinned, every production component's license is reviewed (the build fails on an unreviewed one), and bundled programs are checked against fixed checksums.
12.4 Known vulnerabilities. We check components against published security advisories by hand before each release (for version 2.0, before the first sale), not yet automatically in every build [not yet available].
12.5 The desktop app runs its windows in a sandbox, turns developer tools off in installed copies and checks its own package for changes at start-up.
12.6 Code signing and Updates. The 2.0 installers are not yet code-signed, so Windows may warn of an unknown publisher [to be confirmed]. Download only from https://livingroomlogistics.com or a link we send you, and compare the installer's SHA-256 checksum with the one we publish [to be confirmed]. Automatic updates are a Coming Soon Feature: when available, off unless an Admin turns them on, and installing only Updates signed by us.
12.7 Security reviews. We review our own code for security problems, with the help of automated tools [to be confirmed]; no outside firm has tested the Software or our services yet (section 15).
13. Reporting a security problem
13.1 How. E-mail support@livingroomlogistics.com with what you found, where, how to reproduce it and how to reach you - but no real Customer Data or anyone's personal data.
13.2 What we do. We aim to confirm receipt within 5 business days (our Support Policy, section 12.3), tell you what we decide and when we expect a fix, and, if you wish, credit you when we publish the fix [to be confirmed].
13.3 Good-faith research. We will not take legal action against you for security research that follows these rules [to be confirmed]: test only an Installation you are licensed to use (a Trial counts) and your own accounts; do not access, change, delete or keep others' data (stop and tell us if you come across any); do not disrupt our services or other users (no denial-of-service, spam or social engineering), or test third parties' services; and give us reasonable time (we suggest 90 days) to fix the problem before publishing it. This permits nothing unlawful and binds no one else.
14. Security incidents
14.1 What we do. If we learn of a security incident affecting the Software, our services or data we hold, we act to contain it, investigate it, fix the cause and review what we can improve.
14.2 Telling you. If an incident affects you or data we hold about you, we will tell you without undue delay after confirming it, by e-mail to the address on your License Key or Reseller account (what happened, what data, what we are doing, what you should do), and also tell your Reseller if you bought from one. [to be confirmed]
14.3 Data you gave us for support. If an incident affects Customer Data you sent us for support, we tell you at once. [to be confirmed]
14.4 Notices required by law. We also give any notices that data-breach laws (for example Utah's) or a marketplace's or other provider's terms require of us.
14.5 Incidents on your PC. Outside a Support Session we have no access to your Installation and will usually not know of an incident there; the notices your business must give are yours. Tell us if you suspect the Software was involved, and we will help where we reasonably can.
15. What we do not have yet
Said plainly: no SOC 2, ISO 27001 or other certification and no outside audit; no outside penetration test yet [to be confirmed]; no paid bug bounty; no two-step sign-in for User Accounts; no code-signed installers or automatic updates in version 2.0 [to be confirmed]; and no round-the-clock security team - we respond as quickly as we reasonably can [to be confirmed]. We answer reasonable security questions at support@livingroomlogistics.com.
16. Your part
Security is shared. You are responsible for your PCs and the Windows account that runs the Software (anyone who can use it can use the data), your users, network, Backups and secrets (License Key, Backup Password, Recovery Code, office connection code, outside-access keys), and the files outside the encryption (EULA sections 7.3, 8.3 and 8.7). Keep the office server's port closed to the internet and install Updates promptly.
17. Changes and contact
We update this overview when the Software or our practices change. The version and date at the top show which one applies.
Contact: Point of the Mountain Software LLC. Security reports: support@livingroomlogistics.com. Support: support@livingroomlogistics.com. Privacy: support@livingroomlogistics.com.