Security

Last updated: 18 July 2026

After is built around a simple rule: your ledger stays with you unless you choose otherwise.

1. Local-first vault

Decision and outcome data for the web app are stored in browser local storage on your device. There is no After cloud account required for core use.

2. Transport security

Production hosting should be HTTPS-only. This deployment sets Strict Transport Security, frame denial, and a restrictive Content Security Policy on static responses.

3. What we harden against

• Clickjacking (X-Frame-Options / CSP frame-ancestors)
• MIME sniffing (X-Content-Type-Options)
• Broad third-party script inclusion (CSP defaults)
• Unnecessary device permission prompts (Permissions-Policy)

4. Agent surface

MCP agent tools are disabled by default. Enabling read/write is an explicit user action. Treat agent access like granting a local app permission to your notes.

5. Your operational security

• Use a device lock and up-to-date browser.
• Export backups only to locations you trust.
• Clear the vault before selling or sharing a device.

6. Reporting

If you discover a security issue in a deployment you operate, fix it in the source and rotate any exposed credentials. Do not log sensitive third-party secrets into After notes.