Data & Storage

The seizure model

Suppose someone walks off with the whole server — disks, RAM, and running code. What do they actually get? This page is the honest inventory.

Imagine the police seize the entire building. Privex was designed so that the filing cabinets hold only sealed envelopes and a public phone book. There are no cameras (no IP logs), no guest list (no contacts), and the most sensitive drawers are built to tip over and empty themselves if the power is cut.

Under a full compromise — disk image, live RAM, and the server binary — an attacker recovers pseudonymous public keys, opaque ciphertext, and aggregate counters. There is no PII, no social graph, no IP log, and no plaintext or private key anywhere in the system to recover.

What can be found

  • Public key directory rows + public signatures.
  • Durable OPAQUE records & encrypted recovery shares — only for users who enabled recovery.
  • Encrypted opt-in history blobs, plus their count, size, and timestamps.
  • UNLOGGED rows that happen to exist at seizure time (e.g. queued ciphertext).
  • Infrastructure metadata such as relay_nodes.
  • Aggregate Redis counters, if captured live before TTL expiry.

What is absent by design

  • Routine HTTP access logs (proxy access-log output is discarded).
  • Message, file, and backup plaintext; any private key.
  • Durable sender↔recipient rows (Sealed Sender leaves no sender).
  • A server-side contact list, display-name directory, or phone/email table.
  • Redis snapshots or append-only files (persistence is off).
  • WAL durability for message_queue, kt_log, blob_index, group_state, pow_challenges.
A seizure, traced
what each layer yields to an attacker holding the hardware
Figure. The architecture answers a court order truthfully: there is nothing to hand over, because there is nothing to find.

The controls that make this true

No-log edge

config

The building was never wired for cameras. No visitor is written down, even for a second.

Caddy/nginx discard access logs; /metrics is blocked at every public edge; server version hidden.

Minimal WAL

Postgres

The important drawers empty themselves if the power is cut.

wal_level=minimal, archive_mode=off; UNLOGGED tables never journal and truncate on crash.

Redis no-persist

RAM

The sticky-notes drawer is never photocopied to disk.

save "" + appendonly no; HMAC-namespaced keys; short TTLs.

Encrypted backups

off-host

The only durable copy is a locked box kept elsewhere, holding sealed envelopes only.

Only 4 LOGGED tables; pg_dump | gpg AES-256; ciphertext + px_ ids; RPO ≤ 24h.