Security architecture

Protection model

Message, file and reaction content is protected on the client. The Double Ratchet is the default send path for known recipient devices; device envelopes and epochs support multi-device operation and rotation.

A controlled sender-chain fallback remains while no recipient device is known. VENTEX therefore claims neither exception-free universal E2EE enforcement nor equivalence with an externally audited standard protocol.

• Private object storage and short-lived download paths
• Upload validation for size, media type and checksum
• No independent cryptographic audit claimed

Endpoint boundary

Cryptography does not protect an unlocked, compromised or monitored endpoint. Device loss, session revocation and organisational approvals remain part of the security model.