# Security

> Learn how BucketMate Web keeps credentials local and secure

Canonical: https://docs.bucketmate.app/web/advance/security

BucketMate Web keeps credentials in your browser profile. BucketMate servers do not receive S3 credentials or object data.

```mermaid
flowchart LR
  subgraph Local["Your machine"]
    Web["BucketMate Web"]
    Storage[("Browser profile storage")]
    Passkey["Optional passkey unlock"]
    Extension["Companion extension"]
  end

  subgraph Provider["Storage provider"]
    S3["S3 API"]
    Objects[("Buckets and objects")]
  end

  subgraph Cloud["BucketMate cloud"]
    License["License activation"]
    Telemetry["Telemetry and optional errors"]
  end

  Web --> Storage
  Passkey --> Storage
  Web -- "sign request locally" --> Extension
  Extension -- "forward signed HTTPS request" --> S3
  S3 --> Objects

  Web -- "license check" --> License
  Web -- "sanitized app events" --> Telemetry

  Storage -. "not uploaded" .-> Cloud
  Objects -. "not proxied" .-> Cloud
```

- Delete a connection to remove its saved credentials.
- Clear local app data to remove saved browser data.
- Use **Store as encrypted values** on shared browser profiles.