# Security

> Learn how BucketMate for macOS keeps credentials local and secure

Canonical: https://docs.bucketmate.app/macos/advance/security

BucketMate keeps credentials on your Mac. BucketMate servers do not receive S3 credentials or object data.

```mermaid
flowchart TD
  App["BucketMate app"] --> Keychain["macOS Keychain"]
  Keychain --> Secrets["Access key, secret key, session token"]
  App -- "bucket operations" --> Provider["S3 storage provider"]
  App -- "license, telemetry, optional errors" --> Servers["BucketMate servers"]
  App -. "no S3 credentials or object data" .-> Servers
```

- Connection metadata and cache stay local.
- Deleting a connection removes its saved Keychain secrets.
- AWS Profile and AWS SSO use local AWS files and local login flow.