Security

This page summarises how LL3 protects communication and how to report a security problem to us.

Protection model

• End-to-end encryption. Content is encrypted on the sender’s device and decrypted only on the recipient’s. Our servers relay ciphertext and hold no keys that can read it.
• Post-quantum sessions. Each session combines established classical cryptography with a post-quantum algorithm, so recovering keys would require breaking both.
• Continuously renewed keys. Keys change as a conversation moves, limiting what any single compromised key can reveal.
• Device certification. Devices are certified by the account’s identity and recorded in an append-only transparency log. Hardware-backed attestation is planned and not yet active.
• Revocation. Lost devices can be revoked from another device; deleting an account revokes all of its devices.

What the servers process, and for how long, is listed in the Privacy Policy.

Report a vulnerability

Email contact@ll3.io with “Security report” in the subject. Please include what you found, how to reproduce it, and the app version or page concerned. Our contact details are also published in security.txt.

We aim to acknowledge reports within five business days and will keep you informed while we work on a fix. With your permission, we will credit you once the issue is resolved.

Good-faith research

We will not pursue legal action against research carried out in good faith that respects these rules:

• test only against your own accounts and devices;
• do not access, modify or keep other people’s data;
• do not degrade the service (no denial-of-service or spam);
• give us reasonable time to fix an issue before publishing it.

Social engineering, physical attacks and findings that require a fully compromised device are out of scope.