Security
How We Protect You
Security is not a feature at Wrothen — it's the entire foundation. Every technical decision is made to ensure that your messages remain private, encrypted, and safe.
Zero-Knowledge Encryption
All message content is encrypted with AES-256-GCM using a Data Encryption Key (DEK) unique to you. The DEK is encrypted with a Key Encryption Key (KEK) derived from your passphrase via PBKDF2 (100,000 iterations, SHA-256). Your passphrase is never stored or transmitted — even we cannot decrypt your messages.
HTTPS Everywhere
All connections are encrypted in transit via TLS. HTTP requests are automatically redirected to HTTPS at the Cloudflare CDN layer. HSTS headers ensure browsers always connect securely.
Two-Factor Authentication
TOTP-based two-factor authentication (compatible with Google Authenticator, Authy, and other apps) adds an extra layer of protection to your account.
Rate Limiting & Account Protection
100 requests/minute per IP, 1,000 requests/minute per authenticated user. Account lockout after 5 failed login attempts (15-minute cooldown with email notification).
Encrypted Storage
Media files (voice/video) are stored in Cloudflare R2 with server-side encryption (SSE-S3). All access is via presigned URLs with 1-hour expiry — no public bucket access.
Database Security
PostgreSQL hosted on Neon with SSL-only connections. All sensitive fields encrypted at rest. Parameterized queries prevent SQL injection. Regular dependency audits via Dependabot.
Content Security Policy
Strict Content Security Policy (CSP) headers prevent XSS attacks. Tiptap HTML content is sanitized with DOMPurify. No inline scripts allowed.
Account Deletion
One-click immediate account deletion. All data — drafts, recipients, encryption keys, executor data — is permanently purged. No backups retained. No guilt loops.
Found a vulnerability?
We take security reports seriously. Please contact us at security@deadmandrafts.com for responsible disclosure.