---
title: Security
description: Who can see what, the cryptography, and what we don't promise.
---

# Security

Who can see what, written down so you can check it.

## Who sees what

| | your data | who talks to whom | can act for you |
|---|---|---|---|
| **A relay** (ours or yours) | no | yes, by key, and when and how much | no |
| **Your ISP, the café wifi** | no | that you use a relay | no |
| **A machine you granted** | what you granted | its own sessions | within its grant |
| **An agent you granted** | what you granted | its own sessions | within its grant, logged |
| **A stolen device** | what it held | until revoked | until its revocation arrives |
| **A script in your tab** | what the tab can reach | yes | as the tab, so tabs get the least |

## The cryptography

- **Handshake:** X25519 and ML-KEM-768 together. Both would have to break.
- **Signatures:** Ed25519 and ML-DSA-65 together on keys that live long.
  Classical signatures on short-lived proofs.
- **Messages:** ChaCha20-Poly1305. Every message is numbered and sealed on its
  own, with a replay window for datagrams.
- **The core** depends on crypto crates only, does no IO, and builds without
  an operating system, so it is small enough to audit.

## Checked by tests

Each promise is a requirement with an id. A requirement is only marked done
when a test passes, and one test reads every byte a relay forwarded and fails
if it finds anything you typed.

## Not promised

- **Un-reading.** What someone already read, they keep.
- **Search on our servers.** We can't index ciphertext.
- **The last hop to a device that can't hold a key** (a router, a TV) is only
  as safe as your network or the cable.
- **A browser tab's key is safe from its own page.** A tab is your least
  trusted device.

Found something? Tell us before anyone else. Responsible disclosure details
will be here before the first release.