127.0.0.1 and stored locally in per-case
archives. Birdbrain has no cloud account and no telemetry; captures stay on your machine unless you
export them.
Birdbrain hashes each capture’s stored bytes with SHA-256 and appends a signed entry to a
per-case, hash-chained manifest. It also requests an RFC 3161 timestamp token for the content
hash; a capture holds pending trusted time until the timestamp authority answers, including
while you are offline. You can check the manifest chain in the app, or export an evidence
package whose VERIFY.md runbook reproduces the whole check with sha256sum, openssl, and
jq — no Birdbrain install required.
Birdbrain is beta software and no court has tested the evidence workflow. The
threat model states what the integrity controls defend against and what
they deliberately do not; read it before relying on the evidence claims.
Where to start
- New to Birdbrain? Download Birdbrain has the builds, the platform notes, and what the beta wants reported. Install and first capture walks through installing the app and the extension and taking your first capture. The screenshot tour shows every screen.
- Reviewing the security posture? Start with the architecture page for trust boundaries and the limits of the evidence claims, then the threat model for what the chain-of-custody controls do and do not defend against.
- Adopting Birdbrain for a small group? The privacy-focused adoption guide is written for activists, independent researchers, and small groups.
- Working on the code? Start with the contributing guide and the developer docs in the source repository.