Security

Your designs

• Local by design. CircuitMCP runs on your Windows PC next to Altium. Design files, file names and project contents are never sent to Holley Brothers Design.
• Your LLM, your agreement. What your AI client reads through the tools goes to the LLM provider you chose, under your agreement with them. Use a plan whose data terms suit your work (for example a business or enterprise plan that excludes training on your data).
• No design intelligence on our side. The tools read and write exactly what they are asked to, verify each write by reading the file back, and keep backups before library edits.

The endpoint on your PC

• Token on every request. Each install generates an access token, and every request must carry it, including requests from the same PC.
• DNS-rebinding protection. In Local mode the endpoint listens only on 127.0.0.1 and refuses requests whose Host isn't a loopback name, so a web page can't reach it through your browser.
• Your network, your choice. Network mode is opt-in and meant for a trusted LAN or VPN. TLS certificates can be configured for anything beyond that; never expose the port to the internet.

Licensing

• Minimal data. Activation and renewal send a salted SHA-256 fingerprint of the machine, its Windows hostname and version, and the CircuitMCP version. Our license server also sees the connecting IP address.
• Signed leases. Leases are signed with Ed25519, and release builds accept only leases signed by our key and only over HTTPS. A lease works offline for a limited time, then renews.
• Keys stored hashed. The license server keeps only a hash of each key. The website keeps an encrypted copy so you can view your key again after confirming your password.

Releases

• Code-signed installers (Authenticode, through Microsoft's Artifact Signing service), with the SHA-256 of every release shown on the downloads page.
• No silent updates. The control panel tells you when a new version exists and opens the download page; it never downloads or runs an installer by itself.

This website and your account

• Passwords are hashed with Argon2id and checked against known breaches (using a k-anonymity lookup, so your password never leaves our server). Two-factor authentication with an authenticator app is available to everyone and required for organization owners and admins.
• Sensitive actions, such as viewing or regenerating a license key, changing your email or password, or turning off two-factor, ask for your password again.
• Sessions use a single secure, HTTP-only cookie. Every session can be signed out from your security settings.
• Payments are handled by Stripe on its own pages. Card details never reach our servers.
• Encryption. All traffic uses HTTPS with HSTS. Sensitive fields such as IP addresses in our logs are encrypted in the database, and one-time tokens are stored only as hashes.
• Audit log. Sign-ins, two-factor changes, key views and regenerations, seat changes, member changes and admin actions are recorded in an append-only log. Organization owners and admins can read their organization's log.
• Hosting. The site, its database and the license server run on our own servers in the United States, not on shared multi-tenant platforms.

Reporting a vulnerability

Please email support@circuitmcp.net with “Security report” in the subject. We acknowledge reports within two business days and will keep you updated. Please give us a reasonable time to fix an issue before disclosing it. Business and Enterprise customers can ask for our security questionnaire answers through the enterprise page.