Security Architecture & Data Lifecycle

VeilPair is not a zero-knowledge or end-to-end encrypted system. Transport is secured via HTTPS and WSS, while message text and shared contact cards are encrypted at rest using server-managed envelope encryption (AES-256-GCM). The table below describes the current technical implementation:

Data Category	Collected?	Storage Mechanism	Retention Period
Guest and Pseudonymous Accounts	Yes	Guest identifier with HMAC restore-verifier; optional username and bcrypt password hash in application datastore	Guests: removed after 7 days of inactivity when no retained data dependencies require the identity to remain; registered accounts: retained until deleted
Temporary Room Messages	Yes (ephemeral)	Encrypted at rest (AES-256-GCM) with a unique per-conversation DEK wrapped by a server-managed KEK	Unsaved rooms: 24-hour sliding inactivity expiration; saved rooms: retained until destroyed by a participant
Contact Cards (Exchanged in Room)	Yes (in room)	Encrypted at rest (AES-256-GCM) attached to the room's encrypted message stream	Same lifecycle as the containing conversation
IP Addresses	Processed	In-memory rate limiters and in-memory daily truncated IP-derived visitor hashes; infrastructure may process request logs	IP-derived keys are not attached to room records; in-memory hashes expire after approximately 2 days
Product Analytics	Yes (first-party aggregate)	Persisted daily aggregate counts for sanitized paths, languages, coarse acquisition-source categories, events, and unique visitors	Persisted daily aggregates are retained for 365 days
Feedback & Safety Reports	Yes (optional)	Encrypted at rest under a dedicated feedback encryption key; operator-readable for support/safety review	Retained for 90 days
Ad Trackers / Third-party Pixels	No	None	None

The current application enforces the following lifecycle rules:

• 15-Minute Pairing Window: Pending pairing requests expire after 15 minutes if not approved.
• 24-Hour Sliding Expiration: Unsaved rooms automatically expire 24 hours after the most recent activity.
• 7-Day Guest Inactivity Retention: Inactive guest identities are removed after 7 days of inactivity when no retained data dependencies require the identity to remain.
• Saved Conversations: If a registered participant saves a room to their Vault, automatic expiration is skipped until a participant destroys it.
• Manual Destroy: Destroy Room removes the conversation record, encrypted messages, shared contact data, and wrapped conversation key from the active datastore. Operational backups follow separate access-control and retention procedures. Deletion from the active datastore does not imply immediate deletion from historical backups.
• Close: Closing stops further messaging but retains the room in active storage until expired or destroyed.
• Rate Limit Cleanup: Rate-limiting entries in memory automatically expire and are purged periodically.

VeilPair does not attach raw IP addresses to application-level room or message records.

IP addresses are processed for rate limiting and are combined with the date and an application secret to create a truncated daily visitor hash for aggregate analytics. Reverse proxies, hosting infrastructure, and security systems necessarily process IP addresses and connection metadata for transport. Their exact retention behavior is an operational infrastructure dependency and is not claimed as zero logging.

• In transit: Production traffic uses HTTPS and WSS (TLS).
• At rest: Message text and shared contact cards are encrypted using AES-256-GCM. Each conversation has a unique 256-bit random Data Encryption Key (DEK) wrapped under a server-managed Key Encryption Key (KEK).
• Application trust boundary: Encryption is server-managed. The server runtime holds master KEKs and decrypts message payloads upon delivery to authorized participants. VeilPair is NOT end-to-end encrypted (E2EE) and NOT zero-knowledge.
• Client sessions: Product sessions are server-side revocable and expire after 7 days for guests or 14 days for registered accounts.

Users should not treat VeilPair as protection against a compromised server, compromised participant endpoint, screenshots, or voluntary copying after disclosure.