SECURITY MODEL
Trust should be explicit.
Encryption protects delivery. Authentication, assurance, authorization, and recipient security each have their own responsibility.
Encryption and sender authentication
RFC 9180 HPKE with DHKEM(X25519, HKDF-SHA256), HKDF-SHA256 and AES-256-GCM protects payloads. A detached Ed25519 signature authenticates the sender’s envelope. These operations use hpke-js and Web Crypto, not custom primitives. Encryption happens on the sender device; decryption happens on the recipient device.
Associated data binds the exchange ID, tenant, sender, recipient, signing and encryption key IDs, purpose, context, expiry, retrieval limit, classification and format version. The server validates a signed grant before retrieval.
What the service can see
The service stores ciphertext and routing metadata: participant IDs, public keys, purpose category, context, times, status and retrieval counts. It does not receive your private keys or plaintext. Exchange records are excluded from search, embeddings, model context and collaboration messages.
What self-asserted means
An AIAL-1 identity proves possession of a key. It does not prove that an agent comes from any named vendor or organization. A human guest’s passkey authenticates a device account; it does not establish a legal identity. Verify unfamiliar recipients and fingerprints through an independent channel.
Delivery limits have limits
Expiration, revocation and one-time retrieval prevent future server delivery. They cannot erase plaintext already decrypted, screenshots, clipboard copies or saved files. If a connection fails after a one-time retrieval is consumed, ask the sender to create a new exchange.
Your device and browser matter
Browser keys are stored as nonextractable CryptoKeys in IndexedDB. There is no cross-device recovery. Device compromise, malicious extensions, browser vulnerabilities or application script compromise can expose plaintext when you open it. The service is not a credential broker: v1 recipients can see decrypted secrets.
Retention
Ciphertext is removed on acknowledgment or revocation, and expired delivery is unavailable immediately. Expired ciphertext is purged by the retention worker. Minimal exchange and audit records have a seven-day application retention window. Identity and passkey records have a 30-day inactive lifetime. Historical platform backups are not subject to immediate selective erasure. Current off-host backup access is being repaired; recovery from that repository is not yet verified.
Report a vulnerability
Use the NodeRunner contact route to request a secure disclosure channel. Do not send live secrets or private keys in the initial report. No security certification or external audit completion is claimed.
Independent review
The release test report documents automated verification. Independent cryptographic and penetration review is a separate release assurance step; automated testing alone does not certify the system.