Visibility is Liability.

The short version

What protects your data is built on published, openly reviewed standards, and it’s designed to hold up even if an attacker knows exactly what we use. Your keys and your password do the protecting, not secrecy. What we keep to ourselves is the playbook we use against abuse. Every serious service keeps one.

What’s public

• The cryptography we use, by name: hybrid post-quantum encryption (X25519 with ML-KEM-768), OPAQUE for passwords and MLS for Messages.
• What’s encrypted on your device, and what our servers can’t read, on Security.
• Every promise we make, and everything we refuse to do.
• What we can’t protect you from, on the Threat Model page.
• Every government request we fulfil, on Transparency.
• A person to tell when we’re wrong: security@liecosys.xyz, with public credit for confirmed reports if you want it.
• An independent audit before any paid plan opens, with who did it, what it covered, which version they tested and what we fixed.

What we keep to ourselves

• The exact limits that slow down password guessing, spam and fake sign-ups. Publish them, and people tune their attacks to sit just under them.
• The warning signs we watch for to spot abuse.
• How our servers are laid out inside.
• The inner workings of Seal and the safety password. Knowing they exist doesn’t help anyone tell a real sign-in from a safety one. The details would only help someone hunting for a slip.

That’s the whole list.

If it all leaked tomorrow

Some locks work only while nobody knows how they’re built. Ours are built to work when everybody does. If everything on the private list leaked tomorrow, your data would still be encrypted with keys we don’t have. What would get easier is abuse: spam, guessing, fake accounts. That’s what the list protects.

How you can check us

The promises are specific enough to break. The Threat Model says where they stop. The Transparency log records every request. A person reads security@liecosys.xyz. And an independent audit comes before anyone pays us.

Applies company-wide

The same line holds for this site, anything we publish and anyone speaking for LIECOSYS. Internally, everything is written down in full.