Security built around privacy

SecureRing's job is to make impersonation hard. Our architecture's job is to make sure we never hold more than we need.

Your device controls the keys

SecureRing's verification keys are generated on your device using Ed25519, a modern digital-signature scheme. Your private key never leaves your device and is never uploaded to us. We only ever see your public key, which is safe to share and useless for impersonating you.

This means there is no central database of private keys for an attacker to steal. The thing that lets someone verify as you — your private key — lives only on hardware you control.

Rotating safe words, no server-side secret

The safe word shown on a verified call isn't a password you memorize or a secret we store. It's generated on a SHA-256 hash chain that rotates automatically, so each verification uses a fresh value. There's nothing to forget, nothing to leak in a text message, and nothing an attacker can record once and replay.

What we don't store

• Call audio or video. Streams are carried by our calling provider in transit only; SecureRing never records or stores call content.
• Your private keys. Generated and held on-device only.
• Location, contacts, or call history. We don't collect them at all.
• Biometric data. None, ever.
• A static safe word. Safe words are derived on a hash chain, not stored as a reusable secret.

What we do hold (the minimum)

• Display name — the name others in your circle see.
• Public key — used to verify signatures, safe to share.
• Circle memberships — the identifiers needed to route verification within your trusted circle.
• Push token — so we can alert you to an incoming call or alert.

All data is encrypted in transit and at rest, and retained only as long as needed or required by law. See the privacy policy for the full list.

How we differ from AI companies

Many services collect conversations and behavior to train models. SecureRing does the opposite: we collect too little to train on, we never sell data, and we never use your data for advertising. Our product is verification, not surveillance.

Service providers we rely on

A few features depend on third-party infrastructure: video calls (Twilio), push notifications (Apple APNs / Google Firebase), and encrypted database storage (Supabase). Each is used under its own terms for the narrow function it performs — e.g., Twilio carries call streams in transit only and doesn't store content for us. See the privacy policy for the full sub-processor list.

Honest limits

No verification system is foolproof. SecureRing confirms that a caller's paired device held a valid shared key at the moment of verification — it does not confirm intent, truthfulness, or that the device hasn't been compromised. SecureRing is a supplemental aid, not a guarantee and not a substitute for emergency services or your own judgment. Always verify another way if anything feels wrong.