What we protect you from. And what we don’t.

What LIECOSYS protects against

• A break-in at our end. Notes is encrypted on your device first, so data stolen from our servers can’t be read.
• Us. We store your notes and files, and we can’t open them.
• Data stolen today and cracked later. What you store and share is built to hold against future quantum computers.
• A leaked copy of our database. Your password never reaches us, so it can’t be worked out from what we hold.
• A stolen login. Your session is tied to your device, and a sign-in from a new device or place is checked first. We email you about it.
• Password guessing. Passwords from known breaches are refused, and we email you when someone keeps trying.
• Demands for your data. Every request starts from a refusal, and we can’t hand over what we can’t read.
• Someone forcing you to sign in. A safety password opens a decoy account, and Seal moves your real data out of reach.

What it doesn’t protect against

• Your own device, once it’s compromised or unlocked. Malware, or someone holding your unlocked phone, sees what you see.
• Physical danger. The safety password and Seal protect your data, not your safety. Someone who knows these features exist can keep looking, and misleading lawful authorities may be illegal where you are.
• Losing every way back in. Without your recovery phrase, a signed-in device or a trusted contact, we can’t unlock your encrypted data for you. That’s the price of us never holding your keys.
• The people you share with. Once someone can open a note or a file, they can copy it.
• Fake sign-in pages. A convincing copy of our site can still trick you into typing your password and a code.
• Email, once it launches. LIECOSYS Email won’t be end-to-end encrypted at first, because most mail arrives from other services unencrypted. Use Messages for anything that must stay between you and the other person.
• What we need to run the service. We hold your account details, when you sign in and how much storage you use. A person looks at them only for a security problem, an abuse report or a legal request, and every look is recorded. The Privacy Policy lists exactly what.
• Mistakes we haven’t found yet. Neither LIECOSYS nor the encryption library Messages is built on has been independently audited yet. An outside audit comes before any paid plan opens.

What you can do

• Save your recovery phrase somewhere offline, and add trusted contacts.
• Use a passkey. It only works on the real LIECOSYS, so a fake page gets nothing from it.
• Keep your devices locked and updated. Check your signed-in sessions now and then, and cut off any you don’t recognize.
• Set up a safety password or Seal only after reading their limits above.
• Sign in only at accounts.liecosys.xyz.

Found a gap we missed? Email security@liecosys.xyz. Everything we promise is on Security.