Encrypted connections
Every page and API request is served over HTTPS (TLS), with HSTS so browsers refuse to downgrade to plain HTTP.
Security
What protects you today — and what doesn't yet.
Security claims are only useful if they're precise. Here is what Safegram does to protect your account and data right now, what it does not do yet, and how to report a problem.
In place today
How your account and data are protected
Passwords are never stored
We keep only a salted bcrypt hash of your password. Password-reset links are stored hashed too and expire after an hour.
Sign-in protection
Repeated failed sign-ins are rate limited and temporarily locked for the network they come from, so a stranger can’t lock you out of your own account.
Sessions you control
Changing or resetting your password signs out every other session immediately.
Private messages stay private in the app
Only the members of a conversation can open it. You choose who can message you, and blocked users can’t reach you.
ID documents kept apart
Verification documents live in a private store, are served only to you and the Trust Desk, are never cached, and are deleted with your account.
Safe uploads
Every uploaded file is checked against its real file type and served in a sandbox so it can never run code on Safegram.
Hardened web app
A strict Content Security Policy, link previews that can’t be pointed at internal systems, and rate limits on every abuse-prone action.
Payments verified server-side
Paid features are granted only after Stripe confirms a payment made by your account for that exact purchase — never from a browser redirect alone.
Your data, your call
Download your data or delete your account from Settings at any time.
Not yet
What Safegram does not do yet
End-to-end encryption
Messages are encrypted in transit and protected by access control, but they are stored on our servers in a form Safegram could technically read. End-to-end encryption is on the roadmap.
Third-party identity verification
Verification tiers are self-serve today. Badges show what an account has submitted, not the result of an independent background check.
On-chain identity
RWA UserChain IDs are verifiable cryptographic identifiers, but they are not recorded on a public blockchain yet.
What you can do
- Use a long, unique password and keep the email on your account secure — it is how password resets reach you.
- If you think someone else used your account, change your password: every other session is signed out.
- Set who can message you in Settings → Privacy, and block anyone you don’t want to hear from.
- Don’t share anything in a message you wouldn’t want stored on a server until end-to-end encryption ships.
Found a vulnerability?
Email us with the steps to reproduce it. Please give us a reasonable chance to fix it before sharing it publicly, and don’t access other people’s data or disrupt the service while testing.
security@safegram.ioMore answers in the FAQ. How we handle personal data is in the Privacy Policy.