Skip to content
Ballastra
Open Ballastra

Security

Secure by default. Transparent by design.

These are statements of fact about how Ballastra behaves today — not promises about a perfect platform. Each one is specific enough to check.

15 min

Short-lived sessions

Every request

Server-side revocation

1 h TTL

Signed media URLs

k-anonymity

Breached-password checks

SHA-256

Scoped Aero tokens

Per Nexus

2FA for moderation

WebAuthn

Passkeys & QR login

AES-256-GCM

Encrypted at rest

Guarantees

The figures above summarise the guarantees below. Ballastra does not hold SOC 2 or ISO 27001 certifications, and this page does not claim any.

Authentication

Passkeys & QR login

WebAuthn

Sign in with passkeys (WebAuthn) or by scanning a QR code from a device that is already signed in.

Breached passwords

k-anonymity

Passwords are checked against known breach corpora at signup and login using k-anonymity, so the password itself never leaves Ballastra. You are warned and asked to choose another password.

Sessions

Short-lived tokens

15 min

Access tokens expire after 15 minutes. Refresh tokens are stored hashed and rotate on every use; replaying an old one revokes the whole session chain.

Revocation

Every request

Revoked sessions are checked on every API request and every real-time connection, so "log out everywhere" takes effect immediately.

Media

Signed URLs

1 h TTL

Reading media requires a short-lived signed URL, issued only after a membership check. Media nothing references any more is swept after a grace period.

Aero security

Tokens

SHA-256

Tokens are stored as SHA-256 hashes and shown exactly once; regenerating is the only way to get a new one.

Permissions

Managed role

Every install creates a managed role. The installer decides what is granted, can only grant permissions they hold themselves, and an Aero can never hold Manage Nexus, Manage Roles or Manage Aeros.

Moderation security

2FA for moderation

Per Nexus

A Nexus can require a fresh two-factor check before bans, kicks and role or permission changes. Owners with 2FA enabled confirm it again before deleting a Nexus.

Audit history

Per Nexus

Moderation actions and permission changes are recorded in the Nexus audit log, visible to people with the right permissions.

Encryption status

End-to-end encrypted (optional)

  • 1:1 direct-message text

Not end-to-end encrypted

  • Group chats
  • Space messages
  • Media uploads
  • Voice & video calls

Ballastra offers optional end-to-end encryption for 1:1 direct-message text. Either participant can turn it on for a conversation; message bodies are then encrypted on the sender’s device, and Ballastra relays and stores only ciphertext it cannot read.

Group chats, Space messages, media uploads and voice or video calls are not end-to-end encrypted. Ballastra systems can read that content, which is what makes moderation, reporting and search possible there. Encrypted DM text is not included in search.

There is no key backup yet: losing every device that holds the keys means losing the encrypted history of that conversation.

All traffic is encrypted in transit with HTTPS/TLS. Message bodies are encrypted at rest with AES-256-GCM.

Incident response

We maintain an incident-response runbook and publish one public note per incident — including near-misses — with the metrics we actually track: time to detect, time to contain, and accounts affected.

Disclosure log

No incidents have been declared since this policy took effect. Entries will appear here, dated, as they happen.

Disclosure policy

Researchers can report findings without fear of legal action. If you find a real flaw, here is what we commit to:

  • Acknowledge a report within 3 business days.
  • Triage and give an initial assessment within 10 business days.
  • Fix critical and high issues in the next release cycle, with a public entry in the disclosure log below.
  • Extend safe harbor to researchers who follow the policy: no privacy violations, no destruction of data, no attacks on staff, users or third parties.

Report vulnerabilities inside the app: open Ballastra, go to Support and mark the message as a security issue. Include the affected URL or endpoint, a minimal reproduction and the impact. Test only with accounts you control.

security.txt

The machine-readable policy is published at /.well-known/security.txt.

Related: Privacy · Terms · Safety