Security and data practices
A plain-language overview of where book projects live and which services process account data.
Local-first book projects
Desktop projects are designed to work locally. Optional account, cloud backup and AI features require network services and are only used when those features are invoked.
Accounts and payments
Account services use authenticated sessions. Payment and license transactions are handled through the billing provider identified on the pricing and legal pages; Manusly does not claim to store full card details.
Operational safeguards
- HTTPS is required in production.
- Administrative, API and account areas are excluded from search indexing.
- Session cookies use HttpOnly and SameSite controls.
- Public forms use CSRF validation.
Report a vulnerability
Please send a reproducible report to support@manusly.app. Do not access other users’ data or disrupt the service while testing.