slip/scan is a Rust core over one plain SQLite file, wrapped in a Tauri desktop app, with a CLI and an optional headless server over the same services. Below: why there is no server component, where each piece of work happens, and the invariants the workspace enforces on itself. The version of this argument written for somebody deciding whether to install it is on the landing page.
Most finance apps are a honeypot with a UI on top: your transactions, your bank tokens and everyone else's sit in one database somebody else operates. slip/scan removes the honeypot. There is no slip/scan server — not a small one, not an optional one. Nothing to subpoena, nothing to breach, nothing to shut down and take your books with it.
Books and documents live in one folder you can see, relocate from Settings or with
slipscan data move — a verified copy and an atomic switch, never a half-moved
library. Back it up by pointing your own sync at it: iCloud, Dropbox, Syncthing, a NAS.
slip/scan ships no backup service, and the keychain key never travels with the folder.
Mailbox tokens, LLM keys and webhook signing secrets go into a vault rooted in your OS keychain. They can be set, rotated, revoked and used — never viewed. Not by the UI, not by the CLI, not by a support agent, because there is no support agent. A signing secret is shown exactly once, at create or rotate.
Category taxonomies, merchant mappings and classification rules travel as ed25519-signed packs over git or a file you were handed — there is no registry, and slip/scan never fetches one. Each pack id is pinned to the key that first signed it, so no other key can take that id over later. Rules move; your transactions never do.
Nothing country-specific is compiled in. Chart-of-accounts seeds, tax rates, the name of the return your books produce, bank CSV presets and merchant packs all arrive as region profiles — data you pick. South Africa is the first profile (VAT201); a generic profile covers everywhere else from day one.
Everything below the dashed line happens on the machine in front of you. Sources feed one Rust core; the core owns a plain SQLite database holding your books; the desktop app is a thin IPC shell over the same services the CLI calls. The only endpoint outside the line is one you configured yourself.
These are not aspirations in a marketing page — they are invariants the workspace enforces, most of them with a test that fails the build if they slip.
i64 minor units. Never a float.Not in the core, not over IPC, not across the FX boundary — exchange-rate maths is decimal-only. A cent cannot drift because it was never a binary fraction.Debug impl, or an IPC response.The vault hands out a secret to the code that needs it and nowhere else. A webhook signing secret is shown once, at create or rotate, and is unrecoverable after that — by design, not by oversight.unsafe_code.Whole-workspace lint, no per-crate exemptions. Rust's guarantees are worth having only if nothing quietly opts out of them.not configured, import via the CLI, a review action core supports but desktop has not registered — each one says so in place, instead of offering a button that does nothing.