Skip to content
Ballastra
Open Ballastra

Security

Secure by default. Transparent by design.

These are statements of fact about how Ballastra behaves today — not promises about a perfect platform. Each one is specific enough to check.

15 min

Short-lived sessions

Every request

Server-side revocation

1 h TTL

Signed media URLs

Every login

Breached-password checks

Shown once

Scoped Aero tokens

Per Nexus

2FA for moderation

Passwordless

Passkeys & QR login

Always on

Encrypted at rest

On your device

Secret Leak Guard

Web

Extension Shield

Automatic

Cleaned photo uploads

Guarantees

The figures above summarise the guarantees below. Ballastra does not hold SOC 2 or ISO 27001 certifications, and this page does not claim any.

Authentication

Passkeys & QR login

Passwordless

Sign in with a passkey or by scanning a QR code from a device that is already signed in.

Breached passwords

Every login

Passwords are checked against known data breaches at signup and login, in a way that never sends the password itself anywhere. You are warned and asked to choose another password.

Sessions

Short-lived tokens

15 min

Access tokens expire after 15 minutes. Refresh tokens are stored hashed and rotate on every use; replaying an old one revokes the whole session chain.

Revocation

Every request

Revoked sessions are checked on every API request and every real-time connection, so "log out everywhere" takes effect immediately.

Media

Signed URLs

1 h TTL

Reading media requires a short-lived signed URL, issued only after a membership check. Media nothing references any more is swept after a grace period.

Aero security

Tokens

Shown once

Tokens are stored as one-way hashes and shown exactly once; regenerating is the only way to get a new one.

Permissions

Managed role

Every install creates a managed role. The installer decides what is granted, can only grant permissions they hold themselves, and an Aero can never hold Manage Nexus, Manage Roles or Manage Aeros.

Moderation security

2FA for moderation

Per Nexus

A Nexus can require a fresh two-factor check before bans, kicks and role or permission changes. Owners with 2FA enabled confirm it again before deleting a Nexus.

Audit history

Per Nexus

Moderation actions and permission changes are recorded in the Nexus audit log, visible to people with the right permissions.

Encryption status

End-to-end encryption is temporarily disabled as of October 2026. We are working to restore this feature soon.

End-to-end encryption (temporarily disabled)

  • 1:1 direct-message text — off since October 2026

Not end-to-end encrypted

  • Group chats
  • Space messages
  • Media uploads
  • Voice & video calls

End-to-end encryption is temporarily disabled as of October 2026; it is designed for 1:1 direct-message text. When enabled, either participant can turn it on for a conversation, message bodies are encrypted on the sender’s device, and Ballastra relays and stores only ciphertext it cannot read.

Group chats, Space messages, media uploads and voice or video calls are not end-to-end encrypted. Ballastra systems can read that content, which is what makes moderation, reporting and search possible there. Encrypted DM text is not included in search.

There is no key backup yet: losing every device that holds the keys means losing the encrypted history of that conversation.

All traffic is encrypted in transit. Message bodies are encrypted at rest.

Incident response

We maintain an incident-response runbook and publish one public note per incident — including near-misses — with the metrics we actually track: time to detect, time to contain, and accounts affected.

Disclosure log

No incidents have been declared since this policy took effect. Entries will appear here, dated, as they happen.

Disclosure policy

Researchers can report findings without fear of legal action. If you find a real flaw, here is what we commit to:

  • Acknowledge a report within 3 business days.
  • Triage and give an initial assessment within 10 business days.
  • Fix critical and high issues in the next release cycle, with a public entry in the disclosure log below.
  • Extend safe harbor to researchers who follow the policy: no privacy violations, no destruction of data, no attacks on staff, users or third parties.

Report vulnerabilities inside the app: open Ballastra, go to Support and mark the message as a security issue. Include the affected URL or endpoint, a minimal reproduction and the impact. Test only with accounts you control.

security.txt

The machine-readable policy is published at /.well-known/security.txt.

Related: Privacy · Terms · Safety