Who sees what
Keeps 1 promise
| your data | who talks to whom | can act for you | |
|---|---|---|---|
| A relay (ours or yours) | no | yes, by key, and when and how much | no |
| Your ISP, the café wifi | no | that you use a relay | no |
| A machine you granted | what you granted | its own sessions | within its grant |
| An agent you granted | what you granted | its own sessions | within its grant, logged |
| A stolen device | what it held | until revoked | until its revocation arrives |
| A script in your tab | what the tab can reach | yes | as the tab, so tabs get the least |
The cryptography
Keeps 2 promises
- Handshake: X25519 and ML-KEM-768 together. Both would have to break.
- Signatures: Ed25519 and ML-DSA-65 together on keys that live long (D-2). Classical signatures on short-lived proofs.
- Messages: ChaCha20-Poly1305. Every message is numbered and sealed on its own, with a replay window for datagrams.
- The core depends on crypto crates only, does no IO, and builds without an operating system, so it is small enough to audit.
What isn't promised
Limits stated plainly make the rest believable.
- Un-reading. What someone already read, they keep. A revoke decides what happens next.
- Server-side work on ciphertext. Data the servers can't read, they can't search or index.
- A safe last hop to a peripheral that can't hold a key (a router, a TV). It is only as safe as your network or the cable.
- A browser key safe from its own page. A browser node's key is bytes any script on its origin can read, so it is the least trusted node, and it sits in page memory while unlocked. Later, a key it can't export (Browser).
- A browser's code safe from a network that can mint certificates. The page, its script and the core arrive over TLS, and a proxy with its own certificate authority (a work laptop's inspection box) can serve a page that uses the key. Sessions don't trust TLS, so what is already sealed stays sealed; the page is the gap. A native node checks a signed release; a browser only after one clean load, and only partly (D-20). Later, native mode and noticing interception (D-21).
Found something? Tell us before anyone else. Responsible disclosure details will be here before the first release.