Questions and answers

A member of your entourage sees the requests addressed to them and nothing else. That is a wall rather than a courtesy: every read is filtered by the person the request was given to, so there is no screen, no link and no scroll that reaches the rest of the house.

When somebody leaves, one action ends it. Every link they hold dies at once — not at the next password change, not when a session expires — and every device they bound to it goes with it. Compare that with a message thread, which they keep for as long as they keep the phone.

What no product can promise, and we will not: a person who has read something can repeat it. We limit what reaches them and we end it instantly. We do not claim to reach into anyone’s memory.

A spoken note is held in your phone’s memory, sent once to be turned into text, and discarded. No table and no file store holds audio. There is no archive of your voice to be leaked, subpoenaed or sold.

The transcript is what survives, and it becomes the request. What travels with it, and to whom, is set out in full in the complete answer — including a list of names that goes with every recording, which is the part nobody thinks to ask about.

Every read is scoped to the household it belongs to. That scoping is not merely tested: a script removes each boundary check in turn and requires the test suite to turn red for every one of them. Anything that survives is a test passing for the wrong reason.

It found two of those the first time it ran — one route where the request body failed validation before the boundary was ever consulted, and one whose condition appears three times in a file of which only two were exercised. It is run by hand before a release rather than on every build, and we would rather say so than imply an automation we have not built.

The application, the database and every photograph run at Nine Internet Solutions AG in Zurich, in their data centre in Rümlang. One supplier, one contract, Swiss law and a Swiss forum — not a European region rented from an American company.

That distinction is the question behind the question, and a supplier’s marketing page will not draw it for you: storage in Europe is not a European supply chain. Where the disk stands and who can be compelled to reach it are two separate questions, and only the second one is answered by the name on the contract.

Which obliges us to give our own second answer. Nine’s list of the companies they rely on names one that reaches us: their own company in Canada, for emergency support and maintenance, covering all their products and so ours. The annex records Canada as the place of processing for that row; how far it reaches in practice is Nine’s to state rather than ours to guess, and we would rather write the narrower true thing than the wider comfortable one. Switzerland recognises Canadian law as adequate for commercial processing, so no further safeguard is required. We name it because a paragraph like the one above is only worth writing if it is turned on ourselves.

What no hosting decision reaches: speech and language processing, and the notification relays, which belong to the phone’s maker. Those are in the last answer, and in the complete answer.

The operator console shows names, counts, states and timestamps — never the text of a request. The command line can create a household, suspend it, count rows and erase it, and has no path to a request, a message or a photograph.

The exception is the export that answers “give us everything you hold about us”. Somebody has to be able to read it in order to hand it to you. It costs a fresh passkey every time and writes a line into your household’s own security log, where your chief of staff reads it. We can look, and we cannot look without you being able to see that we did.

This is a rule we keep, not a wall we have built. See the next answer for what that distinction costs.

Encryption under a key dedicated to your household — envelope AES-256-GCM, one key per household, every value bound to its own row so none can be lifted into another, and the key destroyed on erasure so that what is left in any copy is bytes nobody can open — is built and tested. To be exact about a phrase that is often stretched: the household’s key is wrapped under a master key held by us, so this is a key dedicated to your household rather than one you hold against us. Customer-held keys are a different thing and we do not claim them.

Nothing is sealed with it today. It is attached to no column, so what protects your words at rest is Nine’s disk encryption — our supplier, not this product — and they sit readable in our database. Two reasons, and the first is the uncomfortable one: as long as our master key lives in the hosting account, sealing the database would not keep the words from the company that holds it. The second is that losing that key means the content is gone finally — no restore, no support, no recovery — which is a category of accident this product does not otherwise have.

So there is no switch to throw, and we would rather write that than take an order we cannot fill. We review the decision at ten households or in six months, whichever comes first, and immediately if you ask.

When a window passes, the words are overwritten rather than the rows deleted: that a request existed, at that hour, and was settled survives — a record about nobody. Titles, details, the conversation, the private note for the staff and every name attached to any of them go. The proof photograph is deleted outright.

“Kept indefinitely” is an answer somebody gave and not the absence of one: it carries the date it was chosen and a line in your own log. That distinction matters on the day anybody asks whether you knew.

The honest limit: overwriting reaches the live database and not last night’s snapshot, which rolls past on its own thirty-day clock. No command can reach into a backup.

Sign-in is by passkey: a private key that never leaves the owner’s device. A second factor is mandatory for the desk. Your staff have no account, no password and no e-mail address to phish — they hold a signed link bound to the browser that answered a one-time code.

A passkey held in an Apple or Google account exists on every device signed into it, so a device your household has never seen is held until a second channel answers, and the permission then lives as a row we can withdraw rather than a cookie we hope expires.

One deliberate trade, named rather than left to be found: a recovery path by e-mail exists, so control of a principal’s mailbox is a route in. It is what stands between a locked-out principal at midnight and losing their household altogether.