Security
How Labelmate protects your label's data
Your artists' contracts, amounts and bank details are among the most sensitive documents a label holds. Here, plainly, is how Labelmate protects them, including what we haven't done yet.
On your computers
Everything stays with you
Labelmate is a desktop app, not a website. The label's database lives on its computers, encrypted (SQLCipher), with a key kept in the system's secure keychain.
There is no readable copy of your data with us: if our servers were ever compromised, the sealed copies they carry would stay unreadable.
- An encrypted database on every computer
- The key in the system's secure keychain
- No readable copy with us
No password with us
Nothing to break into on our side
Labelmate has no account to break into. Access to the label rests on keys that never leave your computers.
Keys for each computer
Each computer has its own keys. No password of the label is stored with us.
A twelve-word invitation
A new computer joins the label with a twelve-word invitation that never passes through us in readable form.
A signed chain
The list of the label's computers is a signed chain: every addition to it is signed by a computer of the label.
Removing means new keys
Removing a computer changes the label's keys: what is written afterwards can no longer be read by it.
Sync
When several computers work together
For several computers to work together, every change takes the same path, sealed from start to finish.
- 1
Sealed before it leaves
Every change is sealed on the computer that made it, before it leaves that computer.
- 2
Carried by our relay
Our relay only carries these sealed copies, and cannot read them. They are stored in the European Union; requests pass through Cloudflare's worldwide network.
- 3
Every request checked
Every request is signed by the computer that sends it, time-stamped and single-use: an old, replayed or wrongly signed request is refused.
- 4
Opened on the label's computers
Only the label's computers, which hold its keys, can open what the relay brings them.
The artist portal
A sealed page, the key in the link
Sealed on your computer
An artist's page is encrypted on the label's computer (AES-256-GCM) before it leaves for our relay.
The key in the link
The key travels only in the link, after the # sign, a part a browser never sends to a server: neither this site nor the relay can read the page.
Questions too
An artist's question is encrypted in their browser, and only the label's app can read it. The relay deletes it as soon as the app has fetched it.
Taken down in one click
Whoever has the link sees the page. The label takes it down at any time, and it is then deleted from the relay.
Who can do what
Roles, and a signed history
A role per computer
Owner, admin, staff or read-only, written into the signed chain of computers. A read-only computer sees everything and can change nothing: the app refuses every change, and the other computers set aside anything it might send.
A signed history
Every change is signed by the computer that made it and chained to the one before. Settings shows the history: who did what, on which computer and when.
Your mailbox
Read-only, and its password stays with you
Labelmate reads the label's mailbox without moving or deleting anything in it.
Its password stays in the computer's keychain; it is never sent to us.
The AI
Only if you turn it on
Reading by the AI stays off until you turn it on. Before every reading, IBANs, card numbers and social security numbers are masked, and only text is sent to Anthropic's Claude: a document's, or that of an email Labelmate keeps, to spot who is waiting on you. Its commercial terms rule out training on this data.
Every proposed value must quote the passage of the document it came from, and a monthly cap limits what the AI can read.
What stays on your computers
Logs without content, encrypted backups
Logs without content
When the app records what it does, it keeps only identifiers, counts and durations: never an email subject, a name, an amount or a body of text.
Encrypted backups
Labelmate backs up the label's database into your Documents folder, encrypted with a fresh key for each file. Backups stay with you, and are restored with the twenty-four words of the recovery kit.
Signed updates
From version 0.1.2, every six hours the app asks downloads.getlabelmate.com whether a new version exists, sending nothing of the label. An update is installed only once its signature is checked, and only when you click. Automatic checks can be turned off in Settings.
What we don't have yet
So you can judge the rest knowing the gaps
Security pages usually list only wins. Here is what Labelmate doesn't have yet.
No outside penetration test
No penetration test by an outside firm.
No certification
No SOC 2 or ISO 27001 certification.
Windows installer not signed yet
The Mac app is signed and notarized by Apple. The Windows installer is not signed yet: Windows shows a warning at installation.
No fully local AI
No AI that runs entirely on your computer: reading goes through Anthropic.
No bug bounty
No bug bounty program: reports reach a person, not a queue.
Reporting a vulnerability
Found a vulnerability?
Write to contact@getlabelmate.com with enough to reproduce it.
We will not pursue anyone who reports in good faith; give us time to fix it before publishing, and do not reach another label's data while testing.
Read next
All resources- Labelmate
AI in Labelmate
What it reads, what it never does, what is masked and where the text goes.
Read 
LabelmateWorking as a team
Everyone on their own computer, the same label everywhere, and nothing readable on our servers.
Read
The lawRoyalty statements in the US
What record contracts usually ask, and California's audit law.
Read
Your next statements, without spreadsheets.
50% off year one for the first 10 labels, with no risk: you pay nothing until your last statements are rebuilt to the cent.
Apply for accessPhotos Nathan Thomas, Cup of Couple, RDNE Stock project, Khwanchai Phanthong, Daniel Trylski on Pexels.