Data storage and security

Where your data lives, how it is encrypted, and what leaves your machine.

CRQ Pro is built local-first. Your risk data stays on your machine.

Storage and encryption

• All workspaces, scenarios, portfolios, components, and results are stored in a single encrypted file in your operating system's application data directory.

• The file is sealed with AES-256-GCM. The encryption key is generated randomly and stored in your OS credential store: Windows Credential Manager, macOS Keychain, or libsecret on Linux. The encrypted file on disk is useless without an authenticated session as your OS user.

• Writes are atomic (written to a temporary file, then swapped in), so a crash mid-save cannot corrupt your data.

What leaves your machine

Traffic	Purpose
License validation	Verifies your subscription at launch. If unreachable, a 14-day offline grace period applies.
Update check	Checks for new app versions at launch (and on manual Check for updates).

Your scenario data, simulation results, and reports are never transmitted anywhere. There is no telemetry on your risk data and no cloud sync.

Backups

Because the store is encrypted with a key held only in your OS credential store, losing that key, by reinstalling the operating system, moving to a new machine, or a corrupted credential store, makes the on-disk file unrecoverable. A .cqbackup file is plain, portable, and not tied to the machine, so it is your safety net.

Turn on automatic backups (Settings > Application > Backup) and point them at a synced folder for an offsite copy, or export a backup manually. If backups are not configured and nothing has been saved in 30 days, CRQ Pro reminds you. See Import, export and backup.