Security
Security
What Beleg actually defends against — and what it doesn't.
What's protected, and how
Entries are hashed with SHA-256 and chained, so any alteration to past entries is detectable by anyone. Verification runs client-side, so you don't have to trust our server's answer. Anchored chains are timestamped against Bitcoin.
What we store
Your email and name (via Clerk), your venture and entry contents, attestation details, and anchor proofs. Full detail in the Privacy Policy.
Where it runs
Supabase (PostgreSQL, US region) for data, Clerk for authentication, Vercel for hosting, OpenTimestamps public calendars for anchoring. Row-level security is enabled; all reads and writes go through server routes.
Threat model — what Beleg defends against
Silent alteration of past entries, backdating entries, reordering history, forging a witness confirmation after the fact.
What Beleg does not defend against
Someone recording a false claim in the first place. A witness attesting to something untrue. Loss of your account credentials. Beleg proves integrity and timing, not honesty.
Reporting a problem
If you find a security issue, email beleg.app@proton.me. This is a beta product; responsible disclosure is genuinely appreciated.