Nothing leaves this computer except what you send.
Sonda starts by reading local files and then waits for you. There is no telemetry, no analytics, no crash report upload, no check for a new version, no licence server to call. The list of hosts it can ever contact is short, and every one of them is a host you named or a service you configured.
Every host Sonda can contact, and when
Sealed, all of it or none of it.
A startup password is the key to every file Sonda keeps for the account.
The seal
Argon2id — three passes, 64 MiB, four lanes — to a 256-bit key; AES-256-GCM on every file: the workspace, its history, cookies, unsaved tab changes, the mail server, the AI keys, the Git tokens, the team session, the application certificate's private key.
The change
Setting, changing or removing the password reseals every file or none, through a journal: a stop in the middle is finished or undone at the next start. For a team account, one password opens both the local lock and the account's key slot in the store.
The end
Lock now, per account. A collaborative session's files live in a sealed scratch folder that is overwritten and removed on quit, lock, switch or revoke, and at startup after a crash. Factory reset asks for the password, then removes every account, workspace, team, clone and license; only the crash log stays, and it holds no secrets and no server names.
A signed key, opened on your computer.
The same key as Vigia: bought on lockflare.com, pasted once, never checked against anything of ours.
Offline
An Ed25519-signed payload in an AES envelope. Only the verifying half of the key is in the program. It carries the number of users, the expiry and the organization it is bound to. Nothing is ever asked of a server.
Twenty, free, forever
An organization holds twenty active users with no license key, all its divisions together, with no expiry. A key raises the number until its day; past it, the organization holds the free twenty again.
What it gates
The number of active users — checked when an administrator creates a member, approves a join, or a bridge provisions one. Nothing else: every capability is in the free edition.
The three editionsWhat the program is made of.
Go and Vue in one desktop app for macOS — Intel and Apple Silicon — and Windows, amd64 and arm64, signed and notarized.
Own implementations
The HTTP sender, SSE, Socket.IO, STOMP, gRPC-Web and Connect, FIX, HL7 over MLLP, Modbus, HART-IP, DDS over RTPS, the MCP client, SMTP, Digest, SigV4, OAuth 1.0, the cookie jar, the S3, Azure, GCS and WebDAV stores, all eight secret-manager clients, SAML and OIDC, SCIM, the PTY — written from the specifications on the standard library.
No web fonts, no CDN
The editor font is bundled; the editor's workers are served from the program. Nothing is fetched to draw the window.
A terminal, too
A real shell in a bottom panel — your login shell on macOS, PowerShell or cmd on Windows — with search and a 10,000-line scrollback. Nothing saved; closed on lock or quit; never for app runners.