Every recording, every analysis, every personal detail you enter into Cantaris is stored directly on your own computer — not on our servers, not in the cloud. We simply have no access to it.
When you record audio in Cantaris, those files are automatically encrypted using the same standard that banks and governments rely on (AES-256). Think of it as a digital vault: even if someone were to copy the files from your computer, they would be completely unreadable without your personal password.
When you create your Cantaris account, your password generates a unique encryption key. This key is what locks and unlocks your data. We never see your password, we never store it on any server, and we cannot recover it for you. That is why Cantaris gives you a backup code during registration — keep it in a safe place, as it is your only way to regain access if you forget your password.
Cantaris does not track how you use the application. We do not collect usage statistics, we do not run background analytics, and we do not send your personal information anywhere. The only communication between Cantaris and the internet is a brief license check to verify your subscription — and even that contains no personal data, only your license key and device name.
You can export your data at any time in standard, open formats — as audio files, case files, or PDF reports. If you decide to delete your account, Cantaris removes all associated data from your device completely. No residual copies, no hidden backups on our end.
In short: your voice, your data, your device. We built Cantaris so that privacy is not a setting you have to enable — it is the way the software works.
This document provides a technical summary of the security architecture in Cantaris.
Cantaris is a local-first desktop application. All user data — audio recordings, analysis results, and personal metadata — is stored exclusively on the local filesystem. There is no cloud backend, no server-side data store, and no synchronisation service. The application requires no inbound network ports.
Cantaris uses a two-tier key hierarchy. Your password is processed with PBKDF2-HMAC-SHA256 (600,000 iterations, in line with current OWASP guidance) using a 128-bit random salt; the resulting key is used solely to encrypt and decrypt your master key — a 256-bit random key generated at account creation. Individual data files are then protected with per-file keys derived from that master key using HKDF-SHA256, each with its own random salt.
This design means a password change only re-encrypts the master key, never your data, and keeps the expensive password-hashing step off the per-file path. The cryptographic implementation uses the established pycryptodome library.
On account creation, a 256-bit master key is generated using a cryptographically secure random number generator (os.urandom). This master key is encrypted with the user's password-derived key and stored locally. During a session, the master key is held in application memory and cleared on logout.
A one-time backup code is presented to the user during registration, enabling account recovery in case of a forgotten password. Password changes re-encrypt the master key under the new password without requiring re-encryption of all data files.
Authentication is handled entirely locally. Credentials are verified against a local account store — no external identity provider or authentication server is involved. Successful authentication decrypts the master key, which is then used for all subsequent file operations during the session.
The only external communication is license validation over HTTPS (TLS) to cantaris-software.com. This exchange transmits:
No user data, no personal information, no audio, and no analysis results are ever transmitted. The application includes no telemetry, no analytics frameworks, and no third-party tracking services. All runtime dependencies operate locally without network access.
Users can export their data in open, non-proprietary formats (WAV audio, JSON metadata, PDF reports, and portable case-file archives). Account deletion triggers a complete purge of all associated data from the local filesystem, including all recordings, analysis results, and account metadata.
The application's dependency footprint is minimal and limited to well-established, widely audited libraries. No dependencies require network access or perform data collection. A full dependency list is available on request.
This overview covers the application-level security architecture. It does not replace organisational security measures such as full-disk encryption, endpoint protection, or access controls on the host operating system, which remain the responsibility of the deploying organisation.