Sealing happens on the user’s side
Servers store and serve sealed records. They never receive anything that would let them open one.
How we approach security, including our own.
How Ghostables is built, how to report a vulnerability, and a plain account of what our technology does not protect against.
Rules the platform does not break
These rules govern the Ghostables Platform and are written into its engineering specification. Our WordPress products document where they differ.
Keys never leave the user
No key material is sent to a server, written to the database or shared with Ghostables, under any circumstances.
Nothing readable in the database
Protected values are never written to storage in a readable form.
Secrets compared safely
Every comparison involving a secret value is written so its timing reveals nothing about the value.
A core that cannot call out
The part of Ghostables that seals and verifies data has no ability to make network requests.
Well-established building blocks
We use only widely reviewed, standard techniques. We do not invent our own.
What Ghostables does not protect against
Honest disclosure of residual risk is part of the Standard. These are the limits we tell every customer about.
- A device compromised while its owner is signed in can see what that person can see
- In browser-based deployments, people rely on the application code they are served being genuine. A compromised service can capture data entered while it is compromised. Independent attestation of that code is on our roadmap
- People authorised to see data can still misuse what they see
- Some operational details, such as dates and record numbers, may remain visible depending on the product
- If someone loses both their access and their recovery phrase, their sealed data cannot be recovered by anyone
- Ghostables strengthens the technical side of data protection. It does not replace access control, patching, monitoring or staff training
Engineering detail
Available to customers and certification candidates under NDA
Third-party assessment
Not yet completed. We will publish its scope and summary here when it is
Your environment
The platform runs in your systems. Ghostables does not receive or host your protected data
Reporting a vulnerability
If you believe you have found a security issue in any Ghostables product or in this website, please tell us privately before disclosing it anywhere else.
Email hello@ghostables.io with “Security report” in the subject line. We acknowledge every report within 72 hours.
- A description of the issue and its potential impact
- Steps to reproduce it, or a minimal proof of concept
- The product, version and component affected
- Contact
- hello@ghostables.io
- Subject line
- Security report
- Acknowledgement
- Within 72 hours
- Please do not
- Open public issues or disclose before a fix is available
This website
Our marketing pages load no third-party scripts, fonts or trackers. Our enquiry forms send only what you type into them, and nothing is shared with advertisers.
- Third-party scripts
- None
- Fonts
- Served from ghostables.io
- Trackers and analytics
- None
- Security contact
- /.well-known/security.txt