Core Security Principles
End-to-End Encryption
All messages, files, and credentials are encrypted on your device before transmission. Only you and your client have the keys to decrypt. Persay servers only see encrypted data.
Device → Encrypt → Persay Servers (encrypted) → Client Device → Decrypt
Zero-Knowledge Architecture
We literally cannot read your data. Even if compelled by law, subpoenaed, or hacked, the data on our servers is mathematically useless without your encryption keys—which we never have access to.
- Encryption keys derived from your password, never sent to servers
- Biometric authentication unlocks local keys, not server data
- Lost password = lost data (by design—this is a feature, not a bug)
Client-Controlled Data
Your clients control their data. They can download everything. They can delete everything. They can audit access logs. Their data, their control.
Technical Implementation
Encryption Standards
AES-256-GCM for symmetric encryption, RSA-4096 for asymmetric key exchange, Argon2id for password hashing, TLS 1.3 for transport security.
Authentication
FaceID/TouchID for biometric unlock, device-specific encryption keys, secure enclave storage (iOS), hardware-backed keystore (Android).
Infrastructure
Multi-region redundancy, encrypted at rest and in transit, regular security audits, penetration testing.
Compliance
HIPAA compliant (BAA available), GDPR compliant, SOC 2 Type II (in progress), ISO 27001 aligned.
What We Don’t Do
Security isn’t just about what we implement—it’s about what we deliberately don’t do.
No Data Mining
- We don't analyze your content
- We don't train AI models on your data
- We don't extract insights to sell to third parties
No Advertising
- We make money from subscriptions, not ads
- Your attention is not the product
- Your data is not the product
No Backdoors
- No master keys exist
- No law enforcement recovery mechanisms
- No ways for us to bypass encryption
No Tracking
- No invasive analytics
- No cross-web behavior tracking
- No activity profiles
How We Handle Your Data
What We Store (Encrypted)
- Messages: End-to-end encrypted, we see only encrypted blobs
- Files: Encrypted client-side before upload, we store encrypted files
- Credentials: Encrypted in client vault, we cannot access stored passwords
What We Store (Unencrypted Metadata)
- Account info: Email, name, phone (for authentication and billing)
- Metadata: Message timestamps, file sizes, sender/recipient (not content)
- Usage logs: Access logs for security and debugging (IP, device, timestamps)
This metadata is necessary to provide the service but reveals no content of your communications.
Incident Response
If we detect or are notified of a security incident:
- Contain: Isolate affected systems immediately
- Investigate: Determine scope and impact within 24 hours
- Notify: Inform affected users within 72 hours (or as required by law)
- Remediate: Fix vulnerabilities and restore service
- Disclose: Publish transparent post-mortem of what happened and how we’re preventing it
Report Security Concerns
If you discover a vulnerability, please email security@persay.app. We take all reports seriously and will respond within 48 hours.