VENTEX / SECURITY CONTROL ROOM / PUBLIC REGISTER

Security, as a reviewable system.

A public control surface over the existing evidence base. Every claim shows state, technical basis, evidence and boundary from the same dated source.

Open register Evidence Center

PUBLIC CONTROL STATUSEditorially reviewed against repository, tests and operating documentation · 9 September 2026

Claims: 23
Domains: 6
Internally evidenced: 9
Limited / planned: 4

01Claim

02Technical basis

03Evidence

04Boundary

Search claims

Domain

Status

23 / 23

filtered claims from the published evidence base

PRD-01ImplementedGRD-01

Connect brings direct chats, groups and Mission Rooms into one interface.

Evidence basis: Routes, contracts and automated component/API tests for conversations and messages.
Deliberate boundary: Mission Rooms include chat, members, operational roles, lifecycle states, pins and an encrypted mission log; sensors, cameras, tasks and AI summaries are not active.

PRD-02Internally evidencedGRD-01

Web app, API, realtime and files are separated product surfaces.

Evidence basis: Next.js web app, Fastify API, Socket.IO, PostgreSQL/Prisma and private S3-compatible storage.
Deliberate boundary: A modular monolith is not automatically a highly available multi-region platform.

PRD-03LimitedGRD-01

The current product state is a controlled production release.

Evidence basis: Product, security, status and release documentation use the same controlled-release status.
Deliberate boundary: No general availability, certification or approval for highly regulated use.

PRD-04ImplementedGRD-01

Calls, voice messages, forwarding, disappearing messages and controlled history transfer are implemented product paths.

Evidence basis: WebRTC/screen-sharing implementation, MediaRecorder composition, forwarding dialog, expiry logic and device history transfer with automated negative tests.
Deliberate boundary: Background behaviour, push and screen sharing depend on browser and operating system; history transfer is not a server-side plaintext archive.

IAM-01ImplementedGRD-02

Passwords use Argon2id and access tokens remain short-lived.

Evidence basis: Authentication service, configuration bounds and negative route tests.
Deliberate boundary: Secure password storage prevents neither phishing nor compromised endpoints.

IAM-02Internally evidencedGRD-02

Refresh tokens rotate and reuse revokes the affected token family.

Evidence basis: Session logic and automated reuse/revocation tests.
Deliberate boundary: An already compromised unlocked endpoint remains a separate risk.

IAM-03ImplementedGRD-02

Devices, sessions, login history and passkeys are manageable security objects.

Evidence basis: WebAuthn routes, device/session endpoints and management interfaces.
Deliberate boundary: No tenant model, SSO or SCIM provisioning.

IAM-04Internally evidencedGRD-02

Email verification, password recovery, account deletion, panic mode, duress-password access and device revocation use separate confirmed flows.

Evidence basis: Authentication routes, security interfaces and negative tests for verification, reset, deletion, panic, duress authentication, push removal and local browser cleanup.
Deliberate boundary: Server revocation cannot physically erase an endpoint that remains offline or compromised. Local cleanup runs on the next eligible sign-in path, can be blocked by open browser state and reports that condition explicitly.

CRY-01ImplementedGRD-03

Message, file and reaction content has protected client payloads.

Evidence basis: Encryption libraries, API contracts and cryptography/multi-device tests.
Deliberate boundary: The running service still needs routing, membership and timing information; metadata-free operation is not claimed.

CRY-02Internally evidencedGRD-03

Double Ratchet is the default send path without a conversation allowlist; device envelopes, epochs and a downgrade guard support rotation and multi-device operation.

Evidence basis: Rotation, device, double-ratchet and membership proofs in the test stack.
Deliberate boundary: Internal evidence is not an independent protocol and implementation audit.

CRY-04Internally evidencedGRD-03

For capable devices, the version-3 path uses hybrid PQXDH session establishment combining X25519 and ML-KEM-1024; the derived secret becomes the root key of the Double Ratchet.

Evidence basis: Automated cryptography and key-service tests, 308 mapped counter-tests, 19 real-browser runs with 189 checks, multi-device and downgrade scenarios, single-use prekey allocation and a controlled production walkthrough on 6 September 2026; re-run on 9 September 2026.
Deliberate boundary: The post-quantum component protects session establishment, not a continuously post-quantum ratchet. Rollout remains device-dependent and has not yet received an independent external audit.

CRY-05LimitedGRD-03

Profile images require authentication and are protected at rest, but they are not end-to-end encrypted.

Evidence basis: Protected retrieval route, authenticated byte retrieval in the client and current production claim verification.
Deliberate boundary: The service can read profile images. Retrieval requires authentication but does not require an existing communication relationship when an exact account identifier is resolved.

META-03Internally evidencedGRD-03

Direct identifiers have been removed from several stored communication paths or replaced by opaque conversation-scoped references.

Evidence basis: No senderId in message rows, signed authorship inside ciphertext, HMAC direct-chat values, recipient marks instead of device IDs in key envelopes, memberRef for reactions, favourites and mentions, and new read state without new receipt rows. In the current source/test state, the cold-start path reconstructs the identifier directory from encrypted account state and does not treat an empty proof set as success. History transfers there use one computed opaque target mark and skip older unmarked envelopes rather than guessing their destination.
Deliberate boundary: The running service still requires limited account, relationship and technical metadata for authorisation and delivery. The live signed runtime was not updated by this website task; the new cold-start and history-transfer corrections apply there only after a separate app release and migration. Historical time/device references and retained security records remain visible until their defined refresh or cleanup path runs. Metadata minimisation is not metadata absence.

FIL-03ImplementedGRD-03

Uploads are bound to a user and conversation and do not use public buckets.

Evidence basis: Upload grants, size/MIME/checksum validation and short-lived download URLs.
Deliberate boundary: Malware scanning, DLP and server-side video transcoding are not active.

PWA-01ImplementedGRD-04

The web app includes a manifest, service worker, app icons and standalone presentation.

Evidence basis: Public PWA resources, installation interface and service-worker tests.
Deliberate boundary: iOS installation uses Safari rather than the App Store.

PWA-02Internally evidencedGRD-04

The service worker caches public app resources but not API responses or messages.

Evidence basis: Explicit cache allowlist plus offline and update checks.
Deliberate boundary: Offline mode does not expose arbitrarily stale operational history; unsent messages use a local outbox.

PWA-03LimitedGRD-04

Web Push is device-bound, can operate without message plaintext and is removed with device revocation.

Evidence basis: VAPID configuration, subscription endpoints, a default without message preview, and negative revocation and incoming-call push tests.
Deliberate boundary: iOS push requires an installed Home Screen app and explicit permission; delivery remains under OS control.

MSN-01ImplementedGRD-05

Mission Rooms are modelled as a dedicated conversation type.

Evidence basis: Shared contracts, data model, API routes and user interface.
Deliberate boundary: A dedicated type is not yet a complete command-and-control workflow.

MSN-02ImplementedGRD-05

Creating, opening, adding members, communicating, managing files and pins, and controlling the room lifecycle is available.

Evidence basis: Conversation/membership flows, permission matrix, lifecycle routes, file paths, pins and encrypted mission log.
Deliberate boundary: Tasks, live events, camera/sensor feeds and AI summaries are not active.

MSN-03Internally evidencedGRD-05

The public demo presents the approach without pretending to be a production incident system.

Evidence basis: Local signed-out simulator with separate views for timeline, tasks and evidence.
Deliberate boundary: Demo data is illustrative and does not access Connect production.

OPS-01ImplementedGRD-06

The stack has containerised web, API, database, Redis and storage components.

Evidence basis: Production Compose, multi-stage images, health endpoints and migration job.
Deliberate boundary: A single host is not high availability or multi-region operation.

OPS-02Internally evidencedGRD-06

Releases can be gated by types, tests, build, migration, smoke checks and signed release evidence.

Evidence basis: Release script, claim verification, schema-to-migration alignment, browser walkthroughs and a server-side rehearsal of pending migrations in a disposable clone of the running data.
Deliberate boundary: An internal release gate is not a penetration test or operating certification. The migration rehearsal does not modify the running data; an actual recovery exercise from the encrypted backup remains a separate operational proof.

OPS-03PlannedGRD-06

On-premises is architecturally prepared but not a blanket turn-key package.

Evidence basis: Container and module boundaries allow isolated target environments.
Deliberate boundary: Network, secrets, backups, monitoring, recovery, patching and acceptance must be defined per environment.