Security that starts with identity and permission

Message content is encrypted on the user device before it is sent. The VartaaX server is designed to route encrypted content, not read decrypted messages.

Unknown identities go to Requests instead of entering the Inbox directly. Users can allow, ignore, or block identities before normal conversation starts.

Recovery codes help users regain access when they lose normal account access. They should be stored privately because they are part of the user-controlled recovery path.

Trusted-device and fingerprint/passkey flows are convenience unlock layers for supported devices and browsers. They do not replace the need to protect password and recovery material.

Vault is intended for private records that should stay separate from daily conversations. Vault content is encrypted client-side so stored records are not intentionally saved as plaintext.

The server stores account and routing data needed to operate the service, but it is not supposed to receive master keys, private keys, recovery keys, decrypted messages, or decrypted Vault content.