# Security and data · BMAD+ documentation

> What stays on your machine, what can leave it and how to check it.

Canonical: https://bmad-plus.rochetta.fr/docs/security/
Language: en
BMAD+ version: 0.23.1
Documentation reviewed: 2026-10-19
Author: Laurent Rochetta
License: MIT

[BMAD+ documentation](https://bmad-plus.rochetta.fr/docs/)

## Pages in this section

- [Data handling and privacy](https://bmad-plus.rochetta.fr/docs/security/data-handling/): No telemetry and no silent self-update. The eleven flows of the npm package that can send data off your machine, each with what, to whom, when and under which consent, plus what stays local.
- [Trust, ownership and licences](https://bmad-plus.rochetta.fr/docs/security/trust-and-ownership/): Who wrote what, which licences apply, which files BMAD+ owns in your project and how it proves it, what update and uninstall keep, how OSINT is governed, and where the notices live.

[Source on GitHub](https://github.com/lrochetta/BMAD-PLUS)