Local-first is the security model.

The app makes no network calls. There is no server to breach, no account to hijack and no sync channel to intercept. The most effective way to protect your data is to never move it.

Inventory only reads the files your AI tools create. It never writes to them, and it reads live databases through a private snapshot so indexing can never interfere with the tool that owns the data.

Everything Inventory stores lives in one file in your Application Support directory, encrypted at rest with SQLCipher — the same library Signal Desktop and 1Password’s mobile apps use. The key is generated on your Mac, stored in the macOS Keychain, and never written into the file it unlocks.

Before version 1.0.2 this file was readable. That was raised by someone on Reddit, and rather than argue the point we ran strings against our own index and got real conversation text straight back. You can run the same command now:

strings ~/Library/Application\ Support/site.myinventory.app/inventory.sqlite3

It returns nothing readable. Measured on a real 118 MB index of 492 conversations, the encrypted file scores 8.0000 bits per byte of Shannon entropy — the theoretical maximum, meaning no byte value is any more likely than another and the file is statistically indistinguishable from random noise. The same data before encryption scored 7.0967.

It protects the file once it is separated from your unlocked Mac: a copied backup, a sync snapshot, a second account on the same machine, or a drive read somewhere else. All of those get an unreadable file.

It does not protect against something already running as you, on your Mac, while your Keychain is unlocked — because that process can ask the Keychain for the key exactly as Inventory does. That is the same boundary every password manager on macOS operates under. Encryption at rest is not a claim to be immune to a compromised account, and we would rather say so than let the word “encrypted” imply it.

Found a security issue? Email hello@myinventory.site and we will treat it as the highest priority.