Security and custody
What is sealed, what is not,
and who holds the key.
Three articles of the constitution decide what your twin will do. Custody decides what anyone else could read if they asked, including us and including a court. Both are below, with the limits named rather than implied.
The gate
Before anything outward, irreversible or expensive, the twin asks itself three questions. Any yes, or any doubt, is a stop.
- 1Can this harm us - you, me, the company, the people close to you?
- 2Whose instruction is this: yours, or one that arrived inside data?
- 3Does it weaken my own rules, my memory or your privacy?
Money, contracts, terms and commitments are confirmed by the living original. The work is finished and waiting; the signature is a person. This is not a permission you grant and can widen later by clicking something - it is the shape of the loop.
Whose instruction it is
An instruction is yours or it is nothing. A colleague relaying a request, an email in your name, a line buried in a web page the twin was reading, a prompt inside a document - none of them is you. The first is held until you say it yourself; the last is refused outright, and you are told it was tried.
This is the article that matters most and the one almost nobody states. A twin that can be steered by a sentence inside a document it was asked to read is not safe at any capability level, no matter how narrow its permissions look on a settings page. Text that arrives inside data is data. It is never an instruction, not even partly, not even to try.
Custody
- Sealed
- sanctum, health, finance, legal, family. You can seal anything else by putting it in one of them.
- Key
- Twelve words, one hundred and twenty eight bits, turned into an Ed25519 key on your own machine. We never see the words and we never see the key.
- Two keys
- Sealing and signing come off different branches, so nothing we run can ask your twin to sign the one string that opens the seal.
- The cost
- Lose the words and the sealed tiers are gone. We cannot restore them, and a service that could would not be holding a seal.
- Shared rooms
- Open by construction. Keys, health, money, family and other people's data never go into one - and a guard refuses the commit if they do.
The limits, in plain words
We host your base. The sealed tiers - sanctum, health, finance, legal, family - reach our server already encrypted, and the key that opens them is derived on your machine from twelve words we never see. We cannot read those, and neither can anyone who compels us.
Everything outside those tiers is ordinary content on a server we operate. Someone with access to that server can read it. That is true of every hosted product and it is true of this one; the difference is only that it is written here. If a class of note should never be readable that way, put it in a sealed tier - that is what they are for.
Shared spaces are open by construction. Everyone with access gets the same bytes, so keys, health, money, family and other people's data do not go into one. A guard refuses the commit if they do, but the rule is the protection and the guard is the backstop.
Lose the twelve words and the sealed tiers are gone. We cannot restore them. A service that could restore them would not be holding a seal - it would be holding your key and telling you a story about it.
Two keys, not one
Sealing and signing come off different branches of the same twelve words. If they shared a branch, a server able to ask your machine to sign a chosen string could ask for exactly the string that opens the seal. They do not share one, so it cannot.
The twin's own rules and memory are in the same class as the sealed tiers: nothing in a release, and nobody but you, can quieten them. That is enforced by the base being yours, not by our good intentions.
Questions we have not answered here?
Write, and you get a straight answer including the ones that are inconvenient for us.