How do I know this is true?
Because every statement on this page hangs on something you can see or trigger: a checksum, a signature, a button, a log. What we cannot prove is not on this page.
The program is signed before it reaches you
The ZIP runs on the signed Python from python.org. Every update carries a signature from our server (Ed25519); your computer checks it before installing anything and keeps the old version for one more start as a way back. When we build the program we only use packages with a fixed checksum; one byte off and the build stops. Build and checksum of the current program are on the page Share computing.
No foreign code runs on your computer
What your computer does for the community is numbers and text: indexing sections, summarising, answering other members' questions. No program from another member ever lands on your device. Skills are text, models have a built-in checksum, and the house rules filter everything that comes back.
A second device checks what the first one computed
Part of every piece of work goes to a second device as well; if the results disagree, both are discarded. Deepened sections only enter the search once another device has approved them. Whoever gets rejected often stands out. That way we pay no credits for invented work.
One button stops everything
On your side: Pause and Stop in the window, immediately. On ours: the kill switch on the server. When the admin presses it, the server hands out no more questions and no more tasks, every program shows the sentence about it and only answers on its own. There is a second admin so this works even when one of them cannot be reached.
Backed up every night, watched every 5 minutes
The server backs up what the community needs every night and keeps 14 days. A watchdog checks every 5 minutes whether the service answers and restarts it if it hangs; a second watchdog checks from outside every 15 minutes and alerts the admin. Login attempts with a wrong key are blocked for an hour after 5 failures.
Where it is not enough yet
The Windows program does not yet carry a signature from a certificate authority; that is why browsers sometimes warn when downloading. The certificate comes before we open. Test records and source code are not public yet; they come with the licence after the lawyer. An off-site backup is ordered but not yet rehearsed. All of this stays on this page until it is done.
Checked on 21 September 2026 against build 2026-09-20g and service 1.16: signature, fixed checksums, double checking, kill switch, second admin, backup, watchdog. NOT TESTED: restoring from a backup.