Security
Security is our first priority, so here is exactly what that means.
We are two people with no security department. We have a security lead who writes the code, and a short list we follow every time.
Who is responsible
Hans Petur við Streym Hansen
Lead Engineer, Security Lead & Co-Founder
Hans writes the code and answers for its security, with no hand-off in between.
What we do on every system
We audit the systems we run
Including the internal platform we run the business on. We fix what we find.
Published CVEs are patched promptly
On the systems we run: when a dependency gets a published CVE, we patch it then, not at the next feature release.
Secrets stay out of code
Keys and passwords live in environment configuration, not in the repository.
What it looks like in our own products
Each control is in the code today.
| Product | Control |
|---|---|
| Mnemos | End-to-end encrypted sync |
| Mnemos | PKCE sign-in |
| Orpheus and Iris | Signed updates |
| Unios (in development) | Tenant isolation tests |
End-to-end encrypted sync
Data is encrypted on the device (XChaCha20-Poly1305, keys via HKDF-SHA256). The server stores ciphertext it cannot read.
PKCE sign-in
OAuth with PKCE (RFC 7636, S256), so an intercepted sign-in code is useless to anyone else.
Signed updates
Only updates signed with our minisign key are installed. Anything else is rejected.
Tenant isolation, tested
Postgres row-level security keeps tenants apart. A test suite tries to read another tenant's rows and must get a 404.
What we do not offer
If you need one of these, we will point you to a specialist.
Penetration testing as a service
Security certifications such as ISO 27001 or SOC 2. We hold none.
A bug bounty programme
This website
A strict Content Security Policy with no inline scripts
No third-party requests: fonts and scripts are served from our own domain
Analytics without cookies, on our own infrastructure
Found a problem?
Think you found a vulnerability in something we built? Write to us, and Hans replies.
Want this on your system?
Every system we build for you gets the same release review.
Get a quote