Security
Methods is designed so that your source never has to pass through us. These are architecture facts, not certifications, and the second half of this page lists what is not done.
Architecture facts
These follow from how the product is designed. They are structural, not promises.
- Local-first
- The engine runs on your machine or your infrastructure, with a background program. It is useful without an account.
- Source is never proxied through Methods
- Your code does not travel to a Methods server. Work happens where the code already is.
- Provider-agnostic
- Claude, OpenAI, local models, deterministic workers and humans sit behind one abstraction. You choose where a model call goes, including nowhere.
- State lives in your repository
- The graph, contracts, runs and verifications are versioned with your code, so you hold the audit trail.
- Open source
- The core is open source (Apache-2.0), so you can read what it does.
What is in place and what is not yet
This follows our readiness file. An axis is not ready until a row cites a check that ran, its result and the date. A demo that works is not evidence.
| Area | Status | Evidence |
|---|---|---|
| Architecture facts above | Designed, not implemented | They describe the design. Nothing enforces them in code yet. |
| Security model | Not ready | Being written. Nothing enforces it in code yet. |
| Functionality | Not ready | The first feature has not yet gone from contract to merge end to end. |
| Reliability | Not ready | No failure-mode list exists yet. |
| Performance | Not ready | Nothing measured. |
| Installation | Not ready | Not installable; built from source only. |
| Upgrades | Not ready | No version released. Layout and import formats carry a version number so a first upgrade can refuse what it does not understand. |
| Recovery | Not ready | There is no background program to restart yet. |
| Compatibility | Not ready | Fixtures for unrelated repositories are being written; none has been run. |
| Documentation | Not ready | The directive, decision records and domain model exist. Setup, testing and contribution documents are being written. |
| Independent certifications | None held | No SOC 2, ISO 27001 or similar. We will not display a badge we do not hold. |
Status today: pre-alpha, day zero.
Procurement pack
Documents your security and legal teams will ask for. None is written yet. Ask and we will say honestly what exists.
Data processing agreement
Not yet written.
Available on requestSecurity questionnaire
Answers will follow the readiness table above.
Available on requestSecurity model
Being written in the project's security documents.
Available on request
Build with us as a design partner.
Methods is pre-alpha. A small number of teams will run it on real work while it is built, and shape what it becomes.