Security
Report an issue, and see how we think about security.
This page is for responsible disclosure and a plain-language summary of our security posture. It is not a substitute for the full architecture on the Privacy architecture page.
Architecture preview — not a security certification.
Report a security issue
If you’ve found a vulnerability, please report it responsibly rather than exploiting it or disclosing it publicly first.
Contact: legal@chrysaor.net
Please include steps to reproduce, the affected component, and your assessment of impact. We do not currently offer a paid bug bounty; we will acknowledge reports and keep you informed as we investigate.
What we do and don’t claim
- — We do not claim a completed third-party security audit until one has actually taken place.
- — We do not use unsupported or proprietary encryption claims.
- — We do not expose real secrets, keys, or credentials in this documentation.
- — High-assurance language such as “zero-access” is gated behind a completed review; see the Privacy architecture page for how that gate works.
Architecture, in brief
Keys are generated on your device. Sync, if enabled, moves only encrypted objects to a storage location you choose. Chrysaor services are scoped to short-lived verification and essential abuse protection.