Security

Last updated: August 31, 2026

This page describes how QuietAD actually works, including the parts that aren't independently verified yet — we'd rather you know exactly what's been built and what hasn't than oversell it. If you're evaluating this for an environment with real AD write access, this is the page to read closely, not just the marketing homepage.

What QuietAD can and can't reach

The desktop application only ever talks to the domain controller you configure it against, over LDAP/LDAPS. There is no QuietAD server in the loop for the app itself — it doesn't send telemetry, doesn't phone home, and has no network dependency beyond your own DC. The website (quietad.online) is separate infrastructure that only handles licensing and purchases; it never sees anything about your Active Directory environment.

Offline license activation

Your license file is signed with Ed25519, a modern public-key signature scheme. The app verifies that signature locally against a public key built into it — a tampered or forged license file fails verification and the app won't activate. The private signing key never leaves the machine used to issue licenses; it's never transmitted anywhere, including to the app itself.

Confidential AD operations use an encrypted connection

Active Directory itself treats certain attributes and operations as confidential — password resets, new-user password creation, and LAPS password retrieval. AD silently refuses these over a plain LDAP connection even when the account has permission. QuietAD uses an encrypted LDAPS (port 636) connection specifically for these operations, matching what AD itself requires — not an optional extra, a functional requirement.

Nothing leaves your machine except what you configure

Data	Where it goes
Saved admin credentials	Encrypted on disk (Fernet/AES) alongside the app. Never transmitted anywhere.
Action & usage logs	Written to a shared folder you choose on first run, with automatic local fallback if it's unreachable. Never sent to us.
License verification	Fully offline — no network call to check a license is valid.
Website account data (email, purchases)	Stored on your own hosting if you're running the OTP-login backend; separate from the desktop app entirely.

Session hygiene

Saved admin passwords are cleared automatically after 2 hours of inactivity, forcing re-entry before further changes.
Password fields are never logged, in the app's action log or anywhere else.
The app can restrict which OUs it's even allowed to move objects into or enable/disable within — off by default, admin-configurable, defense-in-depth on top of your existing AD permissions.

Verifying the file you actually have

The app has a built-in About / Verify Integrity screen showing a live SHA-256 hash of the running executable. Compare it against the hash we publish to confirm your copy hasn't been modified or tampered with in transit.

Website account security

Login uses one-time email codes — there are no passwords to leak, guess, or reuse from another breach.
Login codes are stored only as hashes, never in plaintext, and expire quickly.
Payment amounts are enforced server-side, not trusted from the browser — the price you're charged can't be altered by tampering with the page.
The whole site runs over HTTPS.

What hasn't happened yet — read this before trusting this for a sensitive environment:

No third-party security audit or penetration test has been performed.
The Windows executable is not yet code-signed with a trusted certificate — Windows and browsers may show an "unrecognized publisher" warning until that's in place. This is actively being worked on.
This is a young product without an extensive independent track record yet. We'd rather say that plainly than have you find out the hard way.

It runs with your account's permissions — nothing more

This is worth stating plainly: QuietAD has no permissions of its own. It isn't a service account, it doesn't run elevated, and it can't do anything your connecting AD account isn't already authorized to do. Every action — moving an object, resetting a password, enabling an account — goes through Active Directory's own permission and delegation checks, the same as it would if you ran the equivalent command in ADUC or PowerShell.

Concretely: if the account you connect with hasn't been delegated rights over a given OU, Active Directory itself rejects the action — QuietAD has no way to override that, bypass it, or escalate around it. The tool is a UI on top of standard LDAP/LDAPS operations, not a separate trust boundary. Scoping down which OUs a given admin or helpdesk tech can touch is something you already do today via AD delegation; QuietAD's own OU-restriction settings (see the Settings tab) are an additional, optional layer on top of that — they never replace it, and they're not what's actually enforcing permissions. AD's own ACLs are.

Who should run this

QuietAD performs directive changes to Active Directory — moving, disabling, deleting objects, resetting passwords. It's built for trained IT administrators and helpdesk staff who already have appropriate, delegated AD permissions for the objects they're managing — not as a general end-user tool, and not as a way to grant capability someone doesn't already have. Restricting who has access to the app itself, and using the built-in OU-scoping for less senior staff, is your responsibility as the deploying admin.

Report a security issue

Found something concerning? Please tell us before disclosing it publicly: support@quietad.online. We'll take it seriously and respond directly.