Journal
What security means in the current build
What we can say today
Requiem does not currently provide end-to-end encryption. Account access and database permissions restrict access, but service infrastructure can process message content. We do not claim that operators are technically unable to read your words.
A private link is a key
The recipient experience uses a random link for a particular release. It expires after 30 days. Anyone who obtains the original link can use it while it remains valid, so it should not be forwarded, posted, or included in a support request.
Expiry is not recall
An expired or revoked link stops future access through that link. It cannot remove a copy someone has already read, saved, photographed, or shared. That is one reason to review recipients carefully before arming a switch.
Keep sensitive secrets elsewhere
Do not place passwords, financial credentials, or other sensitive secrets in the prototype. Use your own established arrangements for information that must remain confidential or be available in a critical situation.
Stronger promises need stronger evidence
A future encryption design must address recipient access and recovery when the sender is unavailable. Until that work is implemented and reviewed, we will describe the current design rather than claim zero-knowledge storage or independent audit approval.