Security
How Labelmate protects your label's data
Your artists' contracts, amounts and bank details are among the most sensitive documents a label holds. Here, plainly, is how Labelmate protects them, including what we haven't done yet.
On your computers
Everything stays with you
Labelmate is a desktop app, not a website. The label's database lives on its computers, encrypted (SQLCipher), with a key kept in the system's secure keychain.
There is no readable copy of your data with us: if our servers were ever compromised, the sealed copies they carry would stay unreadable.
- An encrypted database on every computer
- The key in the system's secure keychain
- No readable copy with us
No password with us
Nothing to break into on our side
Labelmate has no account to break into. Access to the label rests on keys that never leave your computers.
Keys for each computer
Each computer has its own keys. No password of the label is stored with us.
A twelve-word invitation
A new computer joins the label with a twelve-word invitation that never passes through us in readable form.
A signed chain
The list of the label's computers is a signed chain: every addition to it is signed by a computer of the label.
Removing means new keys
Removing a computer changes the label's keys: what is written afterwards can no longer be read by it.
Sync
When several computers work together
For several computers to work together, every change takes the same path, sealed from start to finish.
- 1
Sealed before it leaves
Every change is sealed on the computer that made it, before it leaves that computer.
- 2
Carried by our relay
Our relay, hosted in the European Union (Ireland), only carries these sealed copies. It cannot read them.
- 3
Every request checked
Every request is signed by the computer that sends it, time-stamped and single-use: an old, replayed or wrongly signed request is refused.
- 4
Opened on the label's computers
Only the label's computers, which hold its keys, can open what the relay brings them.
Your mailbox
Read-only, and its password stays with you
Labelmate reads the label's mailbox without moving or deleting anything in it.
Its password stays in the computer's keychain; it is never sent to us.
The AI
Only if you turn it on
Reading by the AI stays off until you turn it on. Before every reading, IBANs, card numbers and social security numbers are masked, and only the document's text is sent to Anthropic's Claude, whose commercial terms rule out training on this data.
Every proposed value must quote the passage of the document it came from, and a monthly cap limits what the AI can read.
What stays on your computers
Logs without content, encrypted backups
Logs without content
When the app records what it does, it keeps only identifiers, counts and durations: never an email subject, a name, an amount or a body of text.
Encrypted backups
Labelmate backs up the label's database into your Documents folder, encrypted with a fresh key for each file. Backups stay with you.
What we don't have yet
So you can judge the rest knowing the gaps
Security pages usually list only wins. Here is what Labelmate doesn't have yet.
No outside penetration test
No penetration test by an outside firm.
No certification
No SOC 2 or ISO 27001 certification.
No notarised app yet
No app signed and notarised by Apple yet, and no automatic updates.
No fully local AI
No AI that runs entirely on your computer: reading goes through Anthropic.
No bug bounty
No bug bounty programme: reports reach a person, not a queue.
Reporting a vulnerability
Found a vulnerability?
Write to contact@getlabelmate.com with enough to reproduce it.
We will not pursue anyone who reports in good faith; give us time to fix it before publishing, and do not reach another label's data while testing.
Read next
All resources- Labelmate
AI in Labelmate
What it reads, what it never does, what is masked and where the text goes.
Read 
LabelmateWorking as a team
Everyone on their own computer, the same label everywhere, and nothing readable on our servers.
Read
The lawRoyalty statements in the US
What record contracts usually ask, and California's audit law.
Read
Your next statements, without spreadsheets.
Free early access for 10 independent labels.
Photos Nathan Thomas, Cup of Couple, RDNE Stock project, Khwanchai Phanthong, Daniel Trylski on Pexels.