VENTEX / SECURITY CONTROL ROOM / PUBLIC REGISTER

Security, as a reviewable system.

A public control surface over the existing evidence base. Every claim shows state, technical basis, evidence and boundary from the same dated source.

Open register Evidence Center

PUBLIC CONTROL STATUSEditorially reviewed against repository, tests and operating documentation · 6 September 2026

Claims: 22
Domains: 6
Internally evidenced: 9
Limited / planned: 3

01Claim

02Technical basis

03Evidence

04Boundary

Search claims

Domain

Status

22 / 22

filtered claims from the published evidence base

PRD-01ImplementedGRD-01

Connect brings direct chats, groups and Mission Rooms into one interface.

Evidence basis: Routes, contracts and automated component/API tests for conversations and messages.
Deliberate boundary: Mission Rooms include chat, members, operational roles, lifecycle states, pins and an encrypted mission log; sensors, cameras, tasks and AI summaries are not active.

PRD-02Internally evidencedGRD-01

Web app, API, realtime and files are separated product surfaces.

Evidence basis: Next.js web app, Fastify API, Socket.IO, PostgreSQL/Prisma and private S3-compatible storage.
Deliberate boundary: A modular monolith is not automatically a highly available multi-region platform.

PRD-03LimitedGRD-01

The current product state is a controlled production release.

Evidence basis: Product, security, status and release documentation use the same controlled-release status.
Deliberate boundary: No general availability, certification or approval for highly regulated use.

PRD-04ImplementedGRD-01

Calls, voice messages, forwarding, disappearing messages and controlled history transfer are implemented product paths.

Evidence basis: WebRTC/screen-sharing implementation, MediaRecorder composition, forwarding dialog, expiry logic and device history transfer with automated negative tests.
Deliberate boundary: Background behaviour, push and screen sharing depend on browser and operating system; history transfer is not a server-side plaintext archive.

IAM-01ImplementedGRD-02

Passwords use Argon2id and access tokens remain short-lived.

Evidence basis: Authentication service, configuration bounds and negative route tests.
Deliberate boundary: Secure password storage prevents neither phishing nor compromised endpoints.

IAM-02Internally evidencedGRD-02

Refresh tokens rotate and reuse revokes the affected token family.

Evidence basis: Session logic and automated reuse/revocation tests.
Deliberate boundary: An already compromised unlocked endpoint remains a separate risk.

IAM-03ImplementedGRD-02

Devices, sessions, login history and passkeys are manageable security objects.

Evidence basis: WebAuthn routes, device/session endpoints and management interfaces.
Deliberate boundary: No tenant model, SSO or SCIM provisioning.

IAM-04Internally evidencedGRD-02

Email verification, password recovery, account deletion, panic mode and duress-password access use separate confirmed flows.

Evidence basis: Authentication routes, security interfaces and automated tests for verification, reset, deletion, panic and duress authentication.
Deliberate boundary: Duress does not retract content already delivered to other devices; local deletion can be blocked by browser state and reports that condition explicitly.

CRY-01ImplementedGRD-03

Message, file and reaction content has protected client payloads.

Evidence basis: Encryption libraries, API contracts and cryptography/multi-device tests.
Deliberate boundary: The running service still needs routing, membership and timing information; metadata-free operation is not claimed.

CRY-02Internally evidencedGRD-03

Double Ratchet is the default send path without a conversation allowlist; device envelopes, epochs and a downgrade guard support rotation and multi-device operation.

Evidence basis: Rotation, device, double-ratchet and membership proofs in the test stack.
Deliberate boundary: Internal evidence is not an independent protocol and implementation audit.

CRY-04Internally evidencedGRD-03

For capable devices, the version-3 path uses hybrid PQXDH session establishment combining X25519 and ML-KEM-1024; the derived secret becomes the root key of the Double Ratchet.

Evidence basis: Automated cryptography and key-service tests, mutation evidence, 18 real-browser runs, multi-device and downgrade scenarios, single-use prekey allocation and a controlled production walkthrough on 6 September 2026.
Deliberate boundary: The post-quantum component protects session establishment, not a continuously post-quantum ratchet. Rollout remains device-dependent and has not yet received an independent external audit.

META-03Internally evidencedGRD-03

Direct identifiers have been removed from several stored communication paths or replaced by opaque conversation-scoped references.

Evidence basis: No senderId in message rows, signed authorship inside ciphertext, HMAC direct-chat values, recipient marks instead of device IDs in key envelopes, memberRef for reactions, favourites and mentions, and new read state without new receipt rows. Opaque membership references are bound to possession proofs; sealed membership names and encrypted account preferences reduce further plaintext.
Deliberate boundary: The running service still requires limited account, relationship and technical metadata for authorisation and delivery. conversation_members still contains an account identifier, users.displayName remains stored with the account, and temporary invitation paths plus legacy receipts have separate removal or retention boundaries. Metadata minimisation is not metadata absence.

FIL-03ImplementedGRD-03

Uploads are bound to a user and conversation and do not use public buckets.

Evidence basis: Upload grants, size/MIME/checksum validation and short-lived download URLs.
Deliberate boundary: Malware scanning, DLP and server-side video transcoding are not active.

PWA-01ImplementedGRD-04

The web app includes a manifest, service worker, app icons and standalone presentation.

Evidence basis: Public PWA resources, installation interface and service-worker tests.
Deliberate boundary: iOS installation uses Safari rather than the App Store.

PWA-02Internally evidencedGRD-04

The service worker caches public app resources but not API responses or messages.

Evidence basis: Explicit cache allowlist plus offline and update checks.
Deliberate boundary: Offline mode does not expose arbitrarily stale operational history; unsent messages use a local outbox.

PWA-03LimitedGRD-04

Web Push is device-bound and can operate without message plaintext.

Evidence basis: VAPID configuration, subscription endpoints and a default without message preview.
Deliberate boundary: iOS push requires an installed Home Screen app and explicit permission; delivery remains under OS control.

MSN-01ImplementedGRD-05

Mission Rooms are modelled as a dedicated conversation type.

Evidence basis: Shared contracts, data model, API routes and user interface.
Deliberate boundary: A dedicated type is not yet a complete command-and-control workflow.

MSN-02ImplementedGRD-05

Creating, opening, adding members, communicating, managing files and pins, and controlling the room lifecycle is available.

Evidence basis: Conversation/membership flows, permission matrix, lifecycle routes, file paths, pins and encrypted mission log.
Deliberate boundary: Tasks, live events, camera/sensor feeds and AI summaries are not active.

MSN-03Internally evidencedGRD-05

The public demo presents the approach without pretending to be a production incident system.

Evidence basis: Local signed-out simulator with separate views for timeline, tasks and evidence.
Deliberate boundary: Demo data is illustrative and does not access Connect production.

OPS-01ImplementedGRD-06

The stack has containerised web, API, database, Redis and storage components.

Evidence basis: Production Compose, multi-stage images, health endpoints and migration job.
Deliberate boundary: A single host is not high availability or multi-region operation.

OPS-02Internally evidencedGRD-06

Releases can be gated by types, tests, build, migration, smoke checks and signed release evidence.

Evidence basis: Release script, claim verification and documented deployment flow.
Deliberate boundary: An internal release gate is not a penetration test or operating certification.

OPS-03PlannedGRD-06

On-premises is architecturally prepared but not a blanket turn-key package.

Evidence basis: Container and module boundaries allow isolated target environments.
Deliberate boundary: Network, secrets, backups, monitoring, recovery, patching and acceptance must be defined per environment.