What runs where.

• Indolent Forge Nesting — the installer and the executable are Authenticode-signed through Azure Trusted Signing. Windows shows the publisher as Blake Holmes (the owner of Indolent Designs LLC; the certificate is individually validated). If SmartScreen ever shows “Unknown publisher” for Forge, do not install it; email us.
• Indolent CAD — orders are open, and the installer link and license key arrive by email after purchase. The installer is code-signed.

Indolent Forge Nesting

• Nothing by default. Nesting, imports, PDF/Excel export and license verification all run offline.
• The Slevin assistant is offline: its reference library ships inside the installer and is searched locally. No API key, no cloud model, no prompts leave the machine.
• The in-app update check contacts our release feed on GitHub to compare version numbers.
• Bug reports you choose to send go through FormSubmit to our support inbox, with a local copy kept in your app-data folder.

Indolent CAD

• License activation and deactivation talk to the Indolent license server.
• The AI prompt-to-spec step sends your part description to the Indolent license server, which relays it to the model. The response is a structured spec, not a file.
• Geometry, shop drawings, DXF/STEP and NC1 files are generated locally and never leave your machine.

• Forge — a small license.json in your per-user app-data folder. Back it up with the rest of your profile; if you lose it, email us and we reissue the key.
• CAD — the seat token is stored in Windows Credential Manager under your user account, not in a plain file. Deactivate this device under Settings > LICENSE clears it and frees the seat.

• Forge keys are Ed25519 signatures. Our server signs your machine ID with a private key that never leaves the server; the app verifies with the matching public key compiled into it. That check needs no network, and a key cannot be forged without the private half.
• A Forge key is bound to one machine ID. Moving PCs means a reissue by email; there is no fee.
• CAD seats are verified against the Indolent server at activation, then cached locally so day-to-day work does not depend on a connection.
• Payment details never touch our servers. Stripe handles checkout; we store the order record, the email address and the issued key.

Found something? Email support@indolent.design with the details. We answer security reports first. See also our privacy policy and refund policy.