Security
modelBridge runs on your machine. Your project and your API keys stay there. This page explains what that means in practice, and how the licence side behaves when something goes wrong.
Your keys and your work
Section titled “Your keys and your work”You bring your own model-provider and assistant API keys. modelBridge stores them locally on your computer and uses them to talk to those providers directly. They are never proxied through modelBridge’s servers, and they are never stored by us.
Your project stays on your machine. What you send to a model — a clip, a frame, a prompt — goes to that provider under your own key. Nothing passes through modelBridge’s servers, and nothing about your footage is sent for licence checks.
The local backend
Section titled “The local backend”modelBridge runs a small local process to handle media work that the panel cannot do on its own. It listens only on your own computer and is not reachable from your network or the internet. Write requests arriving with a browser origin are rejected, so a page open in another window cannot drive it.
Your licence
Section titled “Your licence”Your subscription status is decided by modelBridge’s licence service, not asserted by the plugin. Your activation is issued for one installation, so a licence file copied to another machine is refused there.
Your licence covers two machines. If you are moving to a new computer, release the old one from Settings → Devices on the machine you no longer use — see Activate your license.
When something can’t be checked
Section titled “When something can’t be checked”This is the part worth knowing, because it is where most software gets it wrong.
A failed check never gets treated as a failed licence. If your connection drops, if our service is unreachable, or if the plugin cannot read something it expects, modelBridge treats that as unknown — not as invalid. You are not logged out, your key is not called invalid, and you are never shown a prompt to buy a subscription you already have.
What you will see instead is an honest status: that verification is overdue, that nothing has been cancelled, and what to do about it.
Generating is paused while the state is unknown. Because generations cost you money at your provider, modelBridge will not start billable work it cannot confirm you are entitled to run. This resolves as soon as it can reach the service again.
Working offline is supported for 30 days after the last successful check. That period is measured against the service’s own clock reference, so it is unaffected by your computer’s clock settings.
What licence checks send
Section titled “What licence checks send”A licence check sends your licence key, the identifiers for your installation, and receives back your subscription details — including the name and email address held by our payment provider. It sends no prompts, no media and no project data.
Reporting a security issue
Section titled “Reporting a security issue”If you find a security problem, we would rather hear about it than not. Email
info@modelbridge.app with enough detail to reproduce it. Reports are triaged ahead
of feature work, and we will tell you what we did.
For a fuller technical description of modelBridge’s security posture, including its threat model and its stated limits, see the security overview in the public showcase repository.