Cookies and analytics disclosure

Cookies, communications and security

The application uses the necessary secure HttpOnly SameSite=Lax session cookie for authentication and CSRF. Current application code has no optional marketing/analytics scripts or cookies. Edge providers may set security cookies; service-specific settings and audience requirements need review. No real test email is sent by this mission. TLS, tenant authorization, hashed secrets and expiring sessions are controls, not a security guarantee. Verified operational update, 2026-10-02 UTC: the client application and database use an encrypted LUKS volume. The service refuses to start on the underlying unencrypted path; service restart and locked-volume recovery were tested. Recipient-encrypted off-server backups on the encrypted owner T9 were recovered in memory and checked for integrity. The recovery private key is separate from the server and backup destination. A Mac-side coordinator checks availability and schedules daily verified backups; Mac, network and destination availability remain operational dependencies. A full host reboot has not been tested. Older owner-only rollback copies remain access restricted; this update does not claim that all historical copies were retroactively encrypted. No external-client data has been onboarded. Client retention, deletion/restore reconciliation, provider-account details and onboarding qualification must be completed before registration opens. Security controls do not establish legal compliance or a service-availability guarantee.