Data Security

What the Melyara architecture actually protects, and what it does not.

AES-256 encryption at rest

Content is encrypted in your browser with AES-GCM 256 before being stored. Only unreadable characters remain in the database.

Not "zero knowledge"

We do not use that term because we do not meet it: we keep an encrypted copy of each conversation key so it can be recovered, and the text is decrypted so the AI can reformulate it.

Secure infrastructure

Traffic travels over TLS and data is hosted in certified data centres with restricted access.

Technical Details

GCM algorithm

AES-GCM provides encryption and integrity: tampered content cannot be silently decrypted.

Key management

The key travels in the "#key=" fragment of the link. We also keep an encrypted copy on the server, protected with a secret that is not in the database, so a conversation whose link was lost can be recovered.

AI processing

To reformulate and translate, the text leaves in clear towards OpenAI. That is the part of the journey where encryption does not protect, which is why we ask for consent first.