Security

Documents, passages, pictures, videos, chats, attachments and the pages the assistant read while answering you all carry your account id, and retrieval reads only your rows plus anything explicitly shared with you. A caller with no account reads nothing. Sharing is an offer the other side must accept, can be switched off by either side, and every answer that quotes shared material says whose it is.

Passwords are hashed with scrypt at a cost of about fifty milliseconds per attempt. Provider keys are encrypted with a key kept in the environment, separately from the database and its backups, so a copied database alone decrypts nothing. Session tokens, one-time codes and recovery codes are stored only as hashes.

The session cookie is HttpOnly, Secure and rotated every fifteen minutes of activity. A rotated-away cookie that is presented again after its successor was used is proof that two copies exist; the whole lineage is ended and you are told. A session unused for seven days ends on its own, and an administrator's session lasts one day at most. Every browser signed in to your account is listed on the Security page and can be ended from there.

Any account can enrol an authenticator app; administrators must have a second factor. Adding or sharing a key, exporting a conversation and changing another account's role or lock ask for the second factor again, so a stolen cookie cannot do them on its own. Five wrong answers lock that confirmation for fifteen minutes and tell the owner.

Sign-in attempts are limited per address, per account and by how many different accounts one address tries, so neither hammering one account nor spraying one password across many is possible. Error messages and response times are the same whether or not an account exists.

A lost account is handed back only after evidence the mailbox alone cannot produce, the reset link goes to the address on file and is never shown to the operator, and administrator accounts cannot be recovered from the support console at all. Every step is written to a ledger with who did it.

Uploaded files are served back as plain downloads, never rendered as pages, so a document cannot carry a script into the app. Every uploaded file is size-capped before its body is read, images that would decompress to hundreds of megapixels are refused before decoding, and Python the assistant runs on your data executes in a separate container with no route to the internet.

The database and every uploaded file are backed up daily and a restore is tested rather than assumed. The service runs behind a TLS edge with HSTS, security headers and a strict origin check on every state-changing request. The application is capped in memory and restarts itself, and a watchdog reports outages.

Two automated gates run against every deployment before it is accepted: one proves the recovery console refuses the attacks it was designed against, the other proves the session lifecycle behaves as described above. Independent black-box tests are run against the live service and their findings are fixed and re-verified.

Write to david@zobitas.com with what you found. We answer within two business days, fix confirmed issues before disclosure, and credit you if you wish.