Our security model
Égide is designed against a determined, technically advanced adversary. Every decision follows one simple principle: the publisher must never be able to betray you.
No secrets on our servers
Your phone cryptographically signs its communications with a key sealed in its secure processor. On the enrolment side, our servers hold only public keys: a breach would compromise neither your device nor your identity.
Everything over Tor
Updates travel through a Tor hidden service built into the application. No domain to watch, no destination address readable on the network.
Confidential payment by design
You choose what your purchase reveals about you. With Monero, no third party is involved and we ask for neither a name nor an e-mail address. By bank card, it is simpler, but your bank and our provider see the purchase. Compare the two
What we hold, and what we do not
On our servers
- The obfuscated, derived fingerprint of devices already installed, which is what makes "one installation per device" hold, and which designates nobody
- The public keys of enrolled devices, which cannot be used to harm you
- The premium credit left on a device, designated by an opaque identifier and by nothing else
Nowhere on our side
- Your identity: no account, no e-mail address, no name (no access log has been kept to date, see the privacy policy)
- Your remote wipe program, generated on your side, never transmitted
- Your phone's contents or location
- Your banking data: premium top-ups go through a separate service; in Monero, nothing is entrusted to a third party; by card, your card number and banking data stay with the payment provider and never reach our servers, which learn only that the payment succeeded, with no identity attached
Read what Égide does, do not take our word for it
A security promise you cannot check is worth nothing. So we publish the part of Égide that answers the only question that matters to you: what does this application decide, what does it send, and to whom? The repository contains the code, its tests, and the documentation needed to run it yourself.
What is published
- The rules that decide an erasure: the thresholds, the timers, what arms them and what disarms them.
- The network contract: every request the application can make, where to, and what it contains.
- The cryptography of the device identity, and the test suite that locks all of these rules down.
What is not
- How the erasure is actually carried out on the device.
- How Égide obtains and keeps its full powers over the phone.
- How it resists attempts to uninstall it or tamper with it.
This split is not arbitrary: what stays closed helps a thief, not a reader. Publishing how to disarm an anti-theft system would hand over the manual. So that the gap is not a blind spot, the repository explicitly declares every operation the closed part can perform: you know what exists, without being given the recipe.
You do not have to read us in order to check us: you can watch, with the tools of your choice, every connection Égide opens, when, and to where.
Checking the file you receive
The repository publishes the SHA-256 hash of every release. Compute the hash of the file you received and compare: if they match, your package is byte for byte identical to the one we published. A tampered download, a substituted file or a middlebox rewriting the transfer all become visible. It does not prove, however, that the package was built from the published source: Égide is not a reproducible build, and the repository says so too rather than leaving you to work it out.
Reporting a vulnerability
Write to support@endlesslock.com. You get an acknowledgement within 72 hours, a reasoned assessment within 14 days, and a fix, or a written explanation of why there will not be one, within 90 days. If you would rather not be readable in transit, ask for an encryption key first, and say nothing sensitive in that first message.
And above all: you may publish. You do not need our permission. That right comes from the repository's free-software licence, which is irrevocable.
What we do not promise
No “military-grade anonymity”, no “unbreakable”, no magic. We promise one thing, and it is verifiable: an architecture in which what matters most does not belong to us, neither your identity nor the key that wipes your phone. This is not a contractual undertaking, it is a consequence of the way the product is built.