Security
Sempa runs entirely on a server you own, and there's no Sempa cloud to trust. The whole codebase is open for anyone to read, the project follows a recognised open-source security standard, and every change is scanned and reviewed before it ships. Here's what that means for you.
No jargon required — just the plain reasons Sempa is built to be trustworthy.
Sempa is self-hosted — your tasks, notes, email and calendar stay on infrastructure you control. There's no central service collecting your data, because there's no central service at all.
Every line of Sempa is public under the AGPL-3.0 licence. You don't have to take our word that it's safe — you, or anyone you trust, can read exactly what it does.
Sempa has earned the OpenSSF Best Practices badge — a recognised checklist for how safely an open-source project is run, from code review to vulnerability handling.
Pair Sempa with Tailscale and only your own devices can reach your server — no ports left open to the public internet, with real HTTPS handled for you.
Schedule daily backups — kept local or pushed off-server — and optionally protect them with a passphrase, so a bad upgrade or a failed disk can never cost you your data.
No ads, no trackers, no analytics, no telemetry. Even the optional AI assist runs on a model on your own server — nothing ever leaves it.
The OpenSSF Best Practices programme, run by the Linux Foundation's Open Source Security Foundation, is a public checklist of the things well-run open-source projects do to stay secure. Earning the badge means an independent set of criteria has been met and documented — and the assessment is open for anyone to read.
You don't need any of this to use Sempa safely — but if you like to look under the hood, here's what runs automatically every time code changes or a release is cut.
CodeQL inspects the backend and frontend for security flaws on every push and pull request.
govulncheck and Trivy watch for known vulnerabilities in everything Sempa builds on, and fail the build on serious ones.
gitleaks and push protection make sure passwords and keys never slip into the codebase.
Dependabot opens weekly update requests, so the building blocks stay current and patched.
The full test suite runs on every change, and the main branch is protected — code lands only through reviewed pull requests.
The parsers that read untrusted input — calendar feeds, imported email, AI output — are continuously fuzzed, and tests run under Go's race detector.
Every step that builds and ships Sempa is pinned to an exact version, so the release pipeline can't be quietly swapped from under it.
Desktop and Android downloads are signed with cosign (Sigstore) — you can verify any file before you install it.
The server image runs as a non-root user and is built on digest-pinned bases with a health check — published to GHCR for each release.
Every scan result and any accepted trade-off is documented publicly in the repository's Security tab and SECURITY.md.
If you believe you've found a security issue in Sempa, please report it through GitHub's private vulnerability reporting. That lets the maintainers assess and fix it before any details are made public — protecting everyone who self-hosts Sempa.
Private reports route straight to the maintainer via a GitHub Security Advisory. Non-security bugs and feature requests belong in regular issues.
Everything is in the open. Read the policy, browse the scan results, or read the code itself.