Loading...
Loading...
E2E Encrypted AI
End-to-end encrypted AI for therapy and intimacy. PBKDF2+AES-GCM encryption ensures conversations never leave your device unencrypted.
12
Live
1
Partial
3
Stub
0
Missing
15/18
Pages
19/21
APIs
100%
Security
PBKDF2+AES-GCM encrypted AI conversations
Specialized therapeutic AI persona with safety guardrails
10 guided therapeutic exercises (CBT, mindfulness, etc.)
Encrypted personal memory and reflection storage
Directory of real therapists for referral
Session scheduling — partially implemented
Automated referral to real therapists — UI only
AI-powered crisis and self-harm detection with resource routing
Daily mood tracking with trend visualization
User preferences and profile management
Granular consent controls for data handling
Personal data export — UI exists, no backend
Passkey-based authentication
Bearer token authentication for AI agents — 7 agent-accessible endpoints for chat, mood, conversations, and scheduling
Web Push via VAPID with service worker for conversation and session notifications
Subscription upgrade flow — UI only
| Check | Status |
|---|---|
| CSRF Protection | Pass |
| Rate Limiting | Pass |
| Input Validation | Pass |
| Encryption | Pass |
| Security Headers | Pass |
| Auth / Session | Pass |
| Cache Headers | Pass |
Missing CSP header — risk of script injection
No HSTS header configured
AI has no conversation context — E2E encrypted history not sent to model
user_encryption_keys RLS policy USING(true) exposes encrypted master keys to all authenticated users
veil_passkey_credentials and veil_webauthn_challenges RLS policies USING(true) — any user can read/write all passkey data
Export data feature is stub — privacy compliance gap
Dark/light theme toggle broken on landing page
/api/assistant/chat missing CSRF protection (main /api/chat has it)
No key rotation mechanism for encryption keys
21
Total Routes
19
Rate Limited
18
Total Pages
15
Live Pages