Security & Trust

The promises, in plain words

• 1.Shared proofs are zero-knowledge. Your browser encrypts them (AES-256) before anything is sent. The decryption key lives only in the link you share — it never touches our servers. We physically cannot read what you share.
• 2.Your files have no public URLs. Documents are stored outside the public web and leave the vault only through pages that check you're you.
• 3.Links you control. Every proof link expires on your schedule, can be revoked anytime, and shows only the fields you pick.
• 4.Transfers never touch legal rights. An ownership transfer moves the saved record and history — never title, registration or identity.
• 5.Industry-standard account protection. Hashed passwords (bcrypt), mandatory email verification, brute-force throttling, and error messages that never reveal who has an account.
• 6.No trackers. No ads. No data selling. Our funnel counters are anonymous, self-hosted and cookieless.
• 7.Your exits are open. Export everything, anytime. Delete your account with your password — no phone calls, no forms.
• 8.Honest payments. One-time purchase, 7-day money-back, no stored card data — payments run through Gumroad and UPI.
• 9.Every file is sealed. The moment a document enters your vault, we sign its fingerprint with our cryptographic key. Anyone can later check — in their own browser, without uploading anything — that the file is unchanged since the day you saved it. AI can fake a receipt image; it can't fake a signature dated years earlier.

For the technically curious

The exact measures, verified by automated tests on every change:

In transit

HTTPS/TLS on every connection, enforced with HSTS; strict-transport on subdomains.

Proof links

AES-256-GCM envelope encryption in your browser; 256-bit random keys; only SHA-256 hashes stored server-side; attachments encrypted under their own key.

Transfer links

64-character random tokens, hashed (SHA-256), single-use, expiring, atomically claimed.

Content isolation

Strict Content-Security-Policy (same-origin scripts only, zero third-party origins), X-Frame-Options DENY, nosniff, referrer and permissions policies on every response.

File storage

Private storage outside the web root, opaque UUID paths, server-validated types and sizes, quota enforced server-side, no public disk or share URL — verified by regression test.

Content seals

ECDSA P-256 signature over each file's SHA-256 hash and sealing time (frozen format proofsave-seal-v1); public keys published append-only at /.well-known/proofsave-seal-keys.json; offline verification at /verify runs entirely in your browser.

Abuse resistance

Rate limits on login, registration, reset, proof and claim endpoints; bcrypt password hashing; CSRF tokens on every form and API call.

Accountability

Audit trail of every sensitive action (saves, shares, exports, redemptions, deletions, payments) with ProofSave-side operator controls behind a database flag — never an environment variable.

Supply chain

Zero known vulnerabilities across application dependencies (continuously audited); fonts, the OCR engine and every asset self-hosted — no third-party CDNs or scripts.

Honest boundaries

A trustworthy company tells you what isn't done yet, too:

• Full at-rest encryption of stored files and encrypted, restore-tested backups ship with our production infrastructure (the zero-knowledge vault is on our roadmap and will re-enable document categories).
• Two-factor authentication (2FA) is planned before we scale marketing.
• Proof-link styles still allow inline styles (styles are low-risk; scripts are already strictly locked).
• A seal proves a file is unchanged since we sealed it — it cannot prove the original document was genuine when first saved. Also: the seal clock and key are ours (independent time-witness checkpoints are on the roadmap).