What we can and cannot promise

A member of your entourage sees the requests addressed to them and nothing else. That is a wall rather than a courtesy: every read is filtered by the person the request was given to, so there is no screen, no link and no scroll that reaches the rest of the house.

When somebody leaves, one action ends it. Every link they hold dies at once — not at the next password change, not when a session expires — and every device they bound to it goes with it. Compare that with a message thread, which they keep for as long as they keep the phone.

What no product can promise, and we will not: a person who has read something can repeat it. We limit what reaches them and we end it instantly. We do not claim to reach into anyone’s memory.

A spoken note is held in your phone’s memory, sent once to be turned into text, and discarded. No table and no file store holds audio. There is no archive of your voice to be leaked, subpoenaed or sold.

The transcript is what survives, and it becomes the request. What travels with it, and to whom, is set out in full in the complete answer — including a list of names that goes with every recording, which is the part nobody thinks to ask about.

Every read is scoped to the household it belongs to. That scoping is not merely tested: a script removes each boundary check in turn and requires the test suite to turn red for every one of them. Anything that survives is a test passing for the wrong reason.

It found two of those the first time it ran — one route where the request body failed validation before the boundary was ever consulted, and one whose condition appears three times in a file of which only two were exercised. It is run by hand before a release rather than on every build, and we would rather say so than imply an automation we have not built.

The database is Postgres in Frankfurt; photographs sit in object storage under EU jurisdiction; the application runs in Frankfurt. All three suppliers are American companies, which is a separate question from where the disks are, and we state it because a supplier’s marketing page will not.

SottoV runs on standard Postgres, S3-compatible storage and a plain Node server, so Swiss hosting is a deployment exercise rather than a rewrite. What it does not move is the speech and language processing, or the notification relays, which belong to the phone’s maker.

The operator console shows names, counts, states and timestamps — never the text of a request. The command line can create a household, suspend it, count rows and erase it, and has no path to a request, a message or a photograph.

The exception is the export that answers “give us everything you hold about us”. Somebody has to be able to read it in order to hand it to you. It costs a fresh passkey every time and writes a line into your household’s own security log, where your chief of staff reads it. We can look, and we cannot look without you being able to see that we did.

This is a rule we keep, not a wall we have built. See the next answer for what that distinction costs.

Encryption under your household’s own key — envelope AES-256-GCM, one key per household, every value bound to its own row so none can be lifted into another, and the key destroyed on erasure so that what is left in any copy is bytes nobody can open — is built and tested.

It is off by default, because losing that key means the content is gone finally: no restore, no support, no recovery. That is a category of accident this product does not otherwise have, and it is not one to hand a household without their asking. Until then what protects your words at rest is our suppliers’ disk encryption rather than a key of your own, and they sit readable in our database.

Founding households may switch it on from day one. Ask, and it costs nothing. We also review the default at ten households or in six months, whichever comes first.

When a window passes, the words are overwritten rather than the rows deleted: that a request existed, at that hour, and was settled survives — a record about nobody. Titles, details, the conversation, the private note for the staff and every name attached to any of them go. The proof photograph is deleted outright.

“Kept indefinitely” is an answer somebody gave and not the absence of one: it carries the date it was chosen and a line in your own log. That distinction matters on the day anybody asks whether you knew.

The honest limit: overwriting reaches the live database and not last night’s snapshot, which rolls past on its own thirty-day clock. No command can reach into a backup.

Sign-in is by passkey: a private key that never leaves the owner’s device. A second factor is mandatory for the desk. Your staff have no account, no password and no e-mail address to phish — they hold a signed link bound to the browser that answered a one-time code.

A passkey held in an Apple or Google account exists on every device signed into it, so a device your household has never seen is held until a second channel answers, and the permission then lives as a row we can withdraw rather than a cookie we hope expires.

One deliberate trade, named rather than left to be found: a recovery path by e-mail exists, so control of a principal’s mailbox is a route in. It is what stands between a locked-out principal at midnight and losing their household altogether.

Content is not sealed under your household’s own key unless you ask. Executed countersigned copies of every supplier agreement do not all exist, though each binds by incorporation. Two AI accounts are still being moved onto the company’s name. There is no formal Art. 30 record of processing activities yet. We have never rehearsed a restore, and a backup nobody has restored is a hope rather than a backup. And we have not measured what Apple and Google do with dictation audio from their own recognisers — we describe their documented behaviour and will not claim we watched it.

The complete answer carries each of these at length, along with a defect in our own speech handling that we found while writing that page and named before we had finished fixing it.