SecureRCVD
Security posture
What we claim — and what we don’t
Sealed wire instructions. Ciphertext on the server. Authenticator required. No money movement. Below is the honest seal — product controls, not a purchased badge.
In force today
- E2E envelope crypto — RSA-OAEP + AES-GCM in the browser; server stores ciphertext + wraps only.
- TOTP everywhere that matters — login incomplete without authenticator; step-up on send/open.
- Session hardening — httpOnly cookies, rotation on privilege elevation, idle expiry.
- Origin CSRF defense on mutating authenticated routes.
- Security headers — HSTS, CSP (nonce + strict-dynamic), frame deny, COOP/CORP.
- No bank details in email — notify-only, never the instruction body.
- Internal validation — authenticated pen matrix 27/27, product smoke 20/20, free unauth surface recon PASS.
Not claimed
- Not “SOC 2 compliant” until an independent CPA report exists.
- Not “bank-grade” / “unbreakable” — residual risks remain (malicious JS, endpoint compromise, skipped fingerprint checks).
- Not a substitute for callback verification — always verify high-value wires out-of-band before funding.
- External pen test — independent firm engagement still open; internal tests are not a replacement.
Your job as a user
Compare key fingerprints out-of-band on first high-value send. Keep your recovery kit offline. Treat this app as sealed delivery — not as approval to fund a wire without a human callback.