Security policy

We take security seriously. If you find a vulnerability, please report it privately to the address listed in our /.well-known/security.txt.

Encryption model

Messages are encrypted in your browser with AES-256-GCM. The 256-bit key is generated client-side and lives only in the URL fragment, which browsers never transmit to servers. The operator therefore has no ability to read message content, even with full database access.

Account security

• Passwords hashed with argon2id
• Optional TOTP-based two-factor authentication with backup codes
• Mandatory 2FA for administrative accounts (enforced on first login)
• CSRF protection, secure session cookies, strict Content-Security-Policy