[
  {
    "id": "server-cannot-read-content",
    "claim": "The server stores ciphertext and holds no decryption keys",
    "evidence": "docs/security/WHAT-THE-SERVER-CAN-SEE.md"
  },
  {
    "id": "retention-12h",
    "claim": "Messages and shared files are retained for 12 hours",
    "evidence": "docs/security/FILE-RETENTION.md"
  },
  {
    "id": "room-membership-visible",
    "claim": "The operator can see which devices share a room while the room exists",
    "evidence": "docs/decisions/DEC-009-participation-graph-limits.md"
  },
  {
    "id": "no-ip-in-logs",
    "claim": "The client IP is never written to a log",
    "evidence": "docs/security/WHAT-THE-SERVER-CAN-SEE.md"
  },
  {
    "id": "libre-no-google",
    "claim": "The libre build contains no Firebase or Play Services code",
    "evidence": "docs/security/WHAT-THE-SERVER-CAN-SEE.md"
  },
  {
    "id": "push-intermediary",
    "claim": "Every push path involves an intermediary that sees an opaque wake blob",
    "evidence": "docs/security/WHAT-THE-SERVER-CAN-SEE.md"
  },
  {
    "id": "calls-p2p-turn",
    "claim": "Calls are 1:1 and peer-to-peer over Cloudflare TURN",
    "evidence": "docs/decisions/DEC-003-call-media-transport.md"
  },
  {
    "id": "signing-fingerprint",
    "claim": "The APK signing certificate fingerprint",
    "evidence": "docs/security/RELEASE-KEY.md"
  },
  {
    "id": "checksum-published",
    "claim": "The SHA-256 of every published APK",
    "evidence": "docs/security/REPRODUCIBLE-BUILDS.md"
  },
  {
    "id": "tls-pins",
    "claim": "Which hosts are pinned, and when the pin set expires",
    "evidence": "docs/security/CERT-PINNING.md"
  },
  {
    "id": "no-audit",
    "claim": "No third-party audit has been performed",
    "evidence": "docs/decisions/DEC-008-private-source.md"
  },
  {
    "id": "pilot-price",
    "claim": "Pilot pricing and the absence of free trials",
    "evidence": "docs/gtm/README.md"
  },
  {
    "id": "sub-processors",
    "claim": "The processors involved in operating the service",
    "evidence": "docs/security/SUB-PROCESSORS.md"
  }
]