Built so your stuff stays yours. Even from us.
Is LIECOSYS safe? Here's exactly what you get. Notes and files we can't read. A password that never leaves your device. A login that's useless if someone steals it. A way back in if you lose everything. The same protection in every country. Every line below is something you can hold us to, not jargon you'd have to take on faith.
We can’t read it. Nobody who breaks in can either.
- Notes is encrypted on your device before anything leaves it. We store it. We can’t open it.
- Share a note and it stays encrypted for the person you shared it with. A share ends after 30 days, or sooner if you stop sharing.
- Because we can’t read it, a breach gets nothing readable. Neither does a court order. Neither do we.
Built for attacks that don’t exist yet
- Some attackers steal encrypted data today and sit on it, waiting for quantum computers that can crack it. What you store and share on LIECOSYS is built to hold against them.
- Encryption pairs a classic algorithm with a post-quantum one, X25519 with ML-KEM-768, so it holds as long as either one does.
- That’s the floor, not the ceiling.
Your password stays yours
- Your password never leaves your device, not even to us. Signing in uses OPAQUE, a published protocol that proves you know it without sending it.
- So a stolen copy of our database can’t be used to work out your password.
- Passwords that have turned up in known data breaches are refused before you can use them.
- For the second step, pick a passkey, an authenticator app or an email code. Passkeys can also unlock your apps.
- Someone keeps guessing at your password? We email you.
A stolen login goes nowhere
- Your session is tied to the device you signed in on. Copy it anywhere else and it’s useless.
- New device or new place? We check it’s you before letting anyone in, and we email you about it.
- Add or remove a passkey, change your recovery email, or lose a signed-in device, and you get a clearly marked security email. It won’t hide in the pile.
- Every signed-in session is listed in your account. Cut any of them off whenever you want.
Lose everything. Still get back in.
- One recovery phrase, and it never leaves your device. Recovery never hands us your keys.
- Choose up to three trusted people who can help you get back in, and choose what each of them can reach.
- Nothing is released instantly. You can deny any request.
When someone forces you to sign in
- A safety password opens a convincing decoy account instead of your real one.
- Seal moves your real data out of reach until you choose to restore it.
- They protect your data, not your physical safety. Someone who knows these features exist can still look further.
- We keep the details private because these protect people under pressure. Knowing they exist doesn’t help anyone tell a real sign-in from a safety one.
Leave whenever you want
- Export your account data, your notes and any file, any time.
- Delete your account any time. You have 30 days to change your mind. After that, it’s permanently erased, except the few records the law or our Privacy Policy says we keep.
- If LIECOSYS ever shuts down, you get at least 90 days’ notice, and sign-in and export keep working the whole time.
What we will never do
- Give you less protection because of where you live. No exceptions based on where you live.
- Sell your data or use it for advertising. Not a little. Not “anonymized”. Not ever.
- Hand over data because someone asked. Every government or legal request starts from a refusal and is reviewed personally, one at a time. Zero fulfilled so far, and the log is on Transparency.
- Close your account because of an automated flag. A person reviews every flag.
Our cryptography isn’t homemade. It’s built on published, openly reviewed standards: X25519 with ML-KEM-768 for encryption, OPAQUE for passwords and MLS for Messages. It’s designed to stay safe even when everyone knows exactly what we use. The short list we keep to ourselves is our anti-abuse playbook: the exact limits and warning signs we use against spam and guessing. What we publish, and what we don’t.
Found a security hole?
Email security@liecosys.xyz. It reaches a person, not a ticket queue. There’s no bounty program today. Once your report is fixed and confirmed, we’ll credit you publicly if you want the credit. The one ask: give us a fair window to fix it before it goes public. Full policy and machine-readable contact on Transparency.
Read more
- Privacy Policy: exactly what we collect, and why.
- Products: everything these protections cover today.
- Transparency: government requests, the request log, and how to report a security issue.
- Visibility is Liability: what we publish, and the short list we don’t.
- Threat model: what we protect you from, and what we don’t.
- Sign in with LIECOSYS: add it as a sign-in option for your own product.
Questions people ask
Notes is encrypted on your device, so we can’t read it and neither can anyone who breaks in. Your password never leaves your device, a stolen session is useless elsewhere, and new devices are checked before they get in. The same protection applies in every country.
It doesn’t get them far. Your session is tied to the device you signed in on, so a copied session is useless anywhere else. A sign-in from a new device or place is checked first, and we email you about it.
Your recovery phrase gets you back in, and it never leaves your device. You can also choose up to three trusted people to help. Recovery never hands us your keys.
That’s the design for what you store and share. Encryption pairs X25519 with ML-KEM-768, a post-quantum standard, so data someone records today stays protected against quantum computers built later.
A safety password opens a convincing decoy account instead of your real one, and Seal can move your real data out of reach until you choose to restore it. They protect your data, not your physical safety.
Not yet. And yes, yet. LIECOSYS was founded in August 2026, and there’s no independent third-party audit today. One comes before any paid plan opens, and we’ll publish who did it, what it covered, which version they tested and what we fixed. What you can check right now: every promise on this page, the government request log on Transparency, and your own data, which you can export any time. Security reports go to security@liecosys.xyz.