Your data is encrypted.
We can't read it.
Prefers morning meetings, takes coffee with oat milk
xK9mL2pQ4vR8tY1nW5jH3fG6dS0aE7cBzXuI...
We use thirdface ourselves.
Everyone on our team uses thirdface every day. We built the privacy for us first. I can't see my coworker's memories. They can't see mine. The database admin can't read anyone's data.
Each user gets their own encryption key. Without that key, the data is noise.
Your data stays in Europe.
Everything runs in Dublin on Microsoft Azure. Your data never crosses EU borders. The database has no public IP. Keys live in hardware security modules. Each environment is isolated from the others.
How it works
You get your own key
When you sign up, we generate a 256-bit encryption key just for you. That key gets wrapped by a master key that lives in a hardware security module. Your key never exists unprotected outside that hardware.
Everything gets encrypted first
Your memories, preferences, conversations. All of it gets encrypted with your key before we write anything to the database. By the time data hits storage, it's already ciphertext.
Only your login unlocks it
When you log in, the HSM unwraps your key. Decryption happens in memory while you're using the app. We can't decrypt your data. We don't have access to the unwrap operation for anyone else's key.
The details
If you want to know exactly what's running under the hood.
Encryption
- •Algorithm: AES-256-GCM. Authenticated encryption that protects both the data and its integrity.
- •Nonce: 96-bit random value, unique every time. Stops replay attacks.
- •Associated data: Your user ID is cryptographically bound to the ciphertext. Can't swap data between users.
Key Management
- •HSM: Azure Key Vault Premium. FIPS 140-2 Level 2 certified hardware.
- •Master keys: RSA-HSM 4096-bit. These never leave the HSM. Ever.
- •Your key: 256-bit AES, unique to you. Stored encrypted by the master key.
- •Key derivation: HKDF-SHA256 creates separate subkeys for different purposes.
- •Rotation: Master keys rotate yearly. You get 30 days notice.
Infrastructure
- •Region: Azure North Europe, Dublin. Your data stays in the EU.
- •Compute: Container Apps in isolated networks. Public-facing apps have ingress; workers are internal only.
- •Database: PostgreSQL 16 on private DNS. No public IP.
- •Memory store: Self-hosted vault on a dedicated VM with Qdrant. Completely isolated.
- •Network: Hub-and-spoke setup with VNet peering. Environments can't talk to each other.
Network Security
- •Default deny: All network rules deny by default. We explicitly allow what's needed.
- •Database access: PostgreSQL only accepts connections from Container Apps subnets.
- •Key Vault: Only accessible from inside our virtual network.
- •TLS: TLS 1.3 required for all external traffic.
Data Handling
- •At rest: Sensitive fields are encrypted before they're written to the database.
- •In memory: Plaintext only exists while processing your request. Then it's gone.
- •Backups: Also encrypted. We only ever see ciphertext.
- •Logs: We log errors and performance. Never your actual data.
- •Retention: Logs kept for 90 days.
Questions
They get gibberish. Everything's encrypted with AES-256-GCM before it ever hits our servers. Without your personal key, the data is unreadable. Not hard to read. Impossible.
We hand over encrypted blobs. That's all we have. We don't hold the keys to decrypt anything. A court order doesn't change physics.
Your key is tied to your login. Log in, and it's there. If you think someone got into your account, let us know and we'll rotate your key.