Security
Private by design, not by promise.
A journal is about the most personal software there is. Here is how we protect it, in plain terms.
- Encryption at rest
- Each entry, its reflection, tags, moments and follow-up question are sealed with AES-256-GCM. The key is derived per account with HKDF from a master key held only in our production environment. Pattern reports are sealed the same way.
- Encryption in transit
- Every connection uses TLS. We send HSTS so browsers never fall back to plain HTTP.
- Never trained on
- We do not use your writing to train or fine-tune any model, and our requests to model providers are made with storage for training and evaluation turned off.
- Minimal access
- No one at Daystrata reads entries. Production access is limited to two engineers, requires hardware keys, and is logged.
- Passwords and sessions
- Passwords are hashed with bcrypt. Sessions are signed, expire after 30 days, and end when you delete your account. Google sign-in is available.
- Payments
- Card details go directly to Stripe and never touch our servers.
- Deletion
- Deleting an entry or an account removes the rows and every derived record from the live database immediately. Encrypted backups roll off within 30 days.
- Abuse limits
- Public endpoints are rate limited per connection, and the homepage demo stores nothing at all.
Report a vulnerability
Tell us, and we will thank you.
Email security@daystrata.com with the details. We acknowledge reports within two working days, keep you updated, and credit researchers who want credit. Please do not access other people's data or run tests that degrade the service.