Data Handling & Privacy

Describes published v2.6.0. Companion to SECURITY.md. Source changes do not update an installed release.

Threat models are among the most sensitive documents an organization produces: they enumerate a system's assets, trust boundaries and known weaknesses. This document states precisely what the application does with that data, what leaves your machine, and what does not — so a security or privacy reviewer can approve it on evidence rather than assurances.

---

1. Summary for reviewers

2. Data classification

3. Exactly what leaves the machine

The application has the following network paths. Do not treat this as a fixed domain allow-list for third-party runtimes: authentication, package downloads and enabled MCP servers can use additional endpoints.

3.1 Update check — automatic, disableable

Version 2.6.0 replaces the finite Atom fallback used by older releases with the product-filtered public snapshot below.

Only this product's stable tags are considered. Incomplete or failed discovery does not mean "up to date". A snapshot can identify a newer published version and its recorded assets, but cannot prove that no newer version exists; the snapshot may lag publication. Installer URLs are not invented from an Atom tag.

3.2 GitHub Copilot — only when you invoke an AI feature

Account sign-in, account/model discovery and quota checks may also contact GitHub without a threat-model prompt. The bundled Copilot runtime handles its service requests under its own configuration and your organization's agreement.

3.3 OpenAI-compatible provider — optional, opt-in, self-configured

If you prefer to keep inference inside your own boundary, the provider seam accepts any OpenAI-compatible endpoint — Azure OpenAI, a private gateway, or a locally hosted model.

3.4 Azure Resource Manager — only when you build from a resource group

This discovery path is used by Create → Build from Azure… and the CLI's azure verb. Azure OpenAI and the optional Azure MCP server are separate paths.

Azure builds can write evidence describing the discovery command vocabulary, observations, inferred flows and gaps. Treat the evidence as sensitive inventory, not as a timestamped audit log of every process invocation.

The selected native Azure CLI Python interpreter runs fixed argument shapes without a Windows command shell. The desktop captures a validated subscription ID before listing groups and retains it for discovery. The child disables dynamic extensions, automatic CLI upgrades and CLI telemetry; this is not a promise about every external runtime. Read failures and unconfirmed process cleanup are errors, not empty inventories. See the I/O contract. The evidence describes the command vocabulary, observations, inferences and gaps; it is not a timestamped audit log of every process invocation.

3.5 Assistant data sources (MCP) — separately enabled

Help > Assistant data sources (MCP) has a master switch and per-server opt-in. Built-in sources are disabled initially. Enabling or testing them can start a connection or local process before a model-specific question is asked.

The direct Azure discovery wrapper's fixed command list does not restrict the separate MCP process. Review the server's capabilities, permissions and settings before enabling it. Use least-privilege identities and leave MCP off for an offline-only workflow. Third-party server telemetry is governed by that server, not by the app's no-product-analytics statement.

Restricted profiles

The new source implementation uses an explicit per-profile tool list, disabled master/per-profile defaults, and consent before enablement. Older unrestricted profiles require review and renewed consent; a saved configuration is not silently upgraded into broader access.

The GitHub PAT is never borrowed from Copilot sign-in, gh, or ambient seat-token variables. App entry is masked; the CLI uses interactive entry or a deliberately named environment variable, never a token literal in command arguments. DPAPI protects local storage for the current Windows user, not against processes running as that user. Removing the stored credential does not revoke it at GitHub.

The SDK session policy explicitly disables implicit GitHub MCP, host Git operations, ambient memory/retrieval/environment context, and plugin/skill/hook/config discovery. This restricts the channels controlled by this application; it is not an OS sandbox or a guarantee about a server's own behavior. Allowed tool results and arguments can still be sensitive and can reach the AI provider.

CLI mcp list, show, status and configuration operations are local. mcp test can start runtimes, authenticate and connect; AI invocations additionally require --mcp. The app has its own visible connection controls. Shutdown has bounded graceful cleanup, force-stop escalation and an explicit warning if termination cannot be confirmed. Do not infer authenticated-service acceptance from an offline test. See MCP setup and limits.

3.6 Authentication and installation

Interactive GitHub device-flow sign-in, the bundled Copilot runtime and Azure CLI/server credential acquisition use their respective identity endpoints. Installing or starting package-based integrations can also contact package registries. These requests are distinct from sending a threat-model prompt.

4. Secret redaction before any prompt

Threat models frequently contain accidental secrets (a connection string pasted into a mitigation note, a token in a description). Before any text is sent to a model, the deterministic PromptSafety pass replaces high-confidence secret material with typed placeholders:

The same module flags known prompt-injection patterns embedded in model content. This is a defense-in-depth check, not proof that all injection attempts or sensitive data will be detected. Review AI suggestions and tool use accordingly.

Redaction is deterministic, offline and applied regardless of which provider is configured.

5. Storage, retention and removal

The application maintains no central database, no server-side account, and no cloud state. To remove all data: uninstall, then delete %APPDATA%\ThreatModelReviewer\ and %LOCALAPPDATA%\ThreatModelReviewer\.

5.1 Local activity history

The application can keep a private record of your own activity so you can answer questions like "is this threat model actually getting better?". This is a personal audit trail, not telemetry: it is written to your disk, read only by the app on your machine, and never transmitted anywhere. There is no endpoint that receives it and no code path that sends it.

Where it lives. %LOCALAPPDATA%\ThreatModelReviewer\history\:

There is no database and no additional dependency — plain text files you can read, diff or delete yourself. A total cap (32 MB by default) and the retention window keep the folder bounded.

What a record contains. Every record carries a schema version, a UTC ISO-8601 timestamp, a session id, and one typed payload:

What a record can never contain. The following are absent by construction — the record types have no field capable of holding them, so there is no setting or bug that can turn them on:

• The contents of a threat model — no element names, descriptions, mitigations or properties.
• Any AI prompt or any AI response. AiActionPerformed has exactly five fields: action, model id, duration, success, error kind.
• Finding text — only the check id (e.g. F5), which is a fixed rubric identifier.
• Credentials, tokens or provider keys.

Every free-text field is additionally length-capped (an AI action to 64 characters, a model id to 128, a file name to 260), so no record can grow to hold smuggled prose, and control characters are stripped so a value can never break the one-record-per-line format.

Your controls. All four live in the app's History → Privacy tab and in %LOCALAPPDATA%\ThreatModelReviewer\history\settings.json:

These settings are enforced by the store itself, not by each call site: every record passes through a redaction pass on its way to disk, so a caller that supplies a full path still cannot get that path written when you have said no.

Two further operations put you in control of the data:

• Export my history writes everything retained, plus the settings that produced it, as indented JSON to a file you choose — so you can inspect exactly what is held.
• Clear all history deletes every record and the salt, so identities recorded before the clear cannot be correlated with anything recorded after it.

Deployment note. To disable history fleet-wide, deploy %LOCALAPPDATA%\ThreatModelReviewer\history\settings.json containing { "Enabled": false }.

6. Compliance notes

• Data residency. Because analysis is local, threat models never cross a regional boundary during a deterministic review. Optional AI, image extraction and MCP can send context to remote services; residency then depends on those providers and your configuration. An endpoint's location alone does not establish its full processing/retention terms.
• Personal data. The product is not designed to process personal data. Any personal data is incidental (for example an author's name inside a model) and remains local; email addresses are redacted before any prompt. The local activity history can incidentally hold a file name you chose (e.g. jane-smith-review.tm7); turn off StoreModelNames for a hash-only history, or turn history off entirely.
• Air-gapped review. Deploy the portable ZIP or MSI, disable updates and remote AI, and leave Azure discovery and MCP unused. Deterministic review and local authoring still work; deterministic Azure discovery nevertheless requires network access.
• Auditability. The verdict, score and findings are reproducible: the same input file always yields the same output, which is what makes the results defensible in an audit.

7. Verifying these claims yourself

You do not have to take this document on trust:

1. Watch the network. Run the app behind a proxy or with Fiddler/Wireshark, review a model end to end, and confirm the only request is the release check (and nothing at all once updates are disabled).
2. Run it offline. Disconnect the machine and review a model — the verdict, score, findings and reports are unchanged.
3. Check determinism. Review the same model twice, with and without AI enrichment: the verdict and score are identical.
4. Inspect the packages. The full dependency set is listed in THIRD-PARTY-NOTICES.md — there is no analytics or telemetry package among them.
5. Read your own history. The files under %LOCALAPPDATA%\ThreatModelReviewer\history\ are plain newline-delimited JSON. Open one in any editor and confirm for yourself that it holds counts, scores and hashes — no model content, no prompts and no responses — and that the folder never appears in any outbound request.

---

Questions or an issue with anything stated here? Please open an issue, or report security concerns privately as described in SECURITY.md.