# Security

Done Bear is [local-first](/local-first): your tasks live on your device first, so the list works offline and syncs when you reconnect. MATTHEW & RONI BLODE PTY LTD in Melbourne, Australia operates it. There is no SOC 2 or ISO report. Reviews go through [contact sales](/contact/sales), and vulnerability reports go to hello@donebear.com.

## What you can verify today

Turn the network off, then add, complete and search tasks. They still work, and the changes sync when you reconnect. [How local-first works](/local-first).

## Security and legal reviews

For a company security or legal review, use [contact sales](/contact/sales) or email [hello@donebear.com](mailto:hello@donebear.com). We reply within one business day. We answer your questions about the same product you can try today. There is no SOC 2 or ISO report to send.

## Who operates Done Bear

MATTHEW & RONI BLODE PTY LTD, a company registered in Australia and based in Melbourne, operates Done Bear. See [Privacy](/privacy) and [Terms](/terms).

## Report a vulnerability

Email [hello@donebear.com](mailto:hello@donebear.com). It is the same address listed in [security.txt](/.well-known/security.txt).

## Questions

### Where does my task data live?

On your device first. Done Bear works offline, and changes sync when you reconnect. The local-first page explains how that works.

### How do I run a security or legal review?

Email hello@donebear.com or use the contact sales form. We reply within one business day.

### Do you have SOC 2 or ISO certification?

There is no SOC 2 or ISO report to send. We answer your review questions directly instead.

### How do I report a vulnerability?

Email hello@donebear.com. It is the same address listed in security.txt.

---

Every Done Bear page is listed at https://donebear.com/llms.txt. Any page has a markdown copy at its URL plus `.md`. Start from the map rather than guessing a path.