Security
Security is not a promise.
It is an architecture.
Most services ask you to trust them. Flambeau is built so that you do not need to take our word for it: what you entrust to us is encrypted before it reaches us, and we hold no key.
What we cannot do
In security, what a service cannot do matters more than what it promises not to do.
Read your capsules
The content is encrypted on your device before anything is sent. Our servers only ever receive and store unreadable data. Even under duress — a hack, a subpoena, a rogue employee — there is nothing to read.
Recover a recovery phrase
By default, the recovery phrase is never transmitted to our servers: we can neither retrieve it nor reset it — that accepted limit is what makes the promise credible. One exception exists, and it is yours to make: the “guaranteed delivery” option, off by default, which you can enable recipient by recipient knowing exactly what it trades away.
Deliver a capsule to someone else
Each capsule is encrypted to a single person, mathematically. Even delivered to the wrong recipient, it would remain undecipherable without the right person's recovery phrase.
How it is built
For those who want the detail — no needless jargon, nothing hidden.
Content encryption
AES-256-GCM, one random key per capsule, wrapped to the recipient's RSA-OAEP 2048 public key. The recipient's private key is itself sealed by their recovery phrase (PBKDF2-SHA256 derivation, 600,000 iterations). Everything rests on the browser's native Web Crypto API — zero third-party libraries in the cryptographic core.
Links and tokens
Every link (sign-in, life check, delivery) carries a random 256-bit token, single-use when it must be, with expiry. The database only stores salted fingerprints: a database theft yields no valid link.
Transport and browser
HTTPS everywhere with HSTS, a strict Content-Security-Policy, clickjacking protection. No trackers, no ad scripts, no third-party analytics — nothing beyond the necessary runs on our pages.
Cautious triggering
Before any delivery: one check, then several spaced reminders, over weeks. Signing in is enough to prove presence. And in case of technical doubt, the system is designed NOT to deliver: a late delivery can be caught up, a wrongful one cannot be taken back.
Data hosted in Europe
The database is hosted in Frankfurt (Germany) and our processing runs in the same region. The detail — and what we keep — is described in our privacy policy.
What if Flambeau disappeared?
The honest question for any service meant to last decades. Our answer is structural, not a promise.
At any time, from your vault, you export all your capsules into a single, self-contained HTML file. That file carries its own decryption tool: your loved ones open it with a plain browser, offline, with no account and no Flambeau — today, or in twenty years. If the service were to shut down, your capsules would stay perfectly readable.
That file is encrypted: whoever finds it can read nothing without the recovery phrase. It is the equivalent of letters kept in a drawer — safer, because it is unreadable to a stranger, and it can be duplicated (USB stick, a notary, your own cloud).
The watchkeeper that detects your absence does depend on the service running: it is a convenience, not the foundation. The foundation is browser-side encryption and the export — two things that rely on no one's survival. You never bet your last words on us alone.
Our limits, stated plainly
A service that claims to have no limits is lying. Here are ours.
- —Your capsules' metadata (title, type, recipient's name and email, dates) is not encrypted: it is what lets us show them in your vault and carry out the delivery. Put nothing sensitive in a title.
- —Your email inbox is the key to your account: it receives the sign-in links. Protect it (strong password, two-factor authentication with your provider).
- —The recovery phrase is a responsibility you share with your recipient. Lost by both, the capsule is permanently unreadable — by design.
- —Flambeau is a young service. The code evolves, and we honestly document what remains to be hardened rather than pretending to perfection.