Trust center

Last updated September 26, 2026

Squawk Secret exists to keep passwords, files, and other sensitive information out of inboxes, chats, and tickets. This page explains how we protect what you send and collect, which companies help us run the service, and how to report a security problem.

Encryption

End-to-end encrypted in your browser

• Squawks you create in the app are encrypted in your browser before anything is sent, with AES-256-GCM and a random 256-bit key made for that squawk. The key is placed in the link after the # symbol, which browsers never send to a server. We store only encrypted data and cannot read it.
• Passphrases are processed in the browser with PBKDF2-SHA256 (600,000 iterations). We never receive them. To enforce view limits and lock a squawk after too many wrong passphrases, the recipient's browser sends a proof derived from the key; we store only a one-way fingerprint of that proof.
• Requests (collecting information from others) are end-to-end encrypted too. Your browser creates a key pair for each request (ECDH P-256) and keeps the private key. Responders' browsers encrypt each response to it (AES-256-GCM) before sending, so responses stored on our servers can be read only by you.
• Squawk Boxes work the same way as requests: senders' browsers encrypt to the Squawk Box's key, and the private key is kept only in the team's browsers and a recovery link the team holds.
• Fillable PDF forms (such as Form I-9 or W-4) are filled in and signed in the responder's browser, and the completed PDF is encrypted there before it is sent. Blank forms are stored so they can be shown to responders; they contain no answers.
• Files are encrypted the same way as the text they're sent with. Each item is encrypted separately so pieces cannot be swapped or mixed.

Where the line is

• The API: squawks created through the API are encrypted on our servers as they arrive (AES-256-GCM), because your system sends us the content to protect. The key is placed in the link and never stored.
• Emailed links: if you ask Squawk Secret to email a squawk link, the link (including its key) passes through our mail system to reach the recipient. It is never stored. A passphrase shared another way keeps even emailed squawks end-to-end.

In transit and at rest

• All connections use HTTPS, and browsers are told to always use HTTPS for our site (HSTS).
• Secrets we must keep to run the service, such as webhook signing secrets and single sign-on settings, are encrypted in our database with AES-256-GCM.
• Account passwords are stored only as scrypt hashes, never in a form that can be reversed.
• Nightly backups are encrypted with AES-256-GCM before they leave our servers, with a key kept separately from the backup storage.

Your data

• Squawks are erased within minutes of reaching their view limit or expiring, and can last at most 30 days. Erased content cannot be recovered, by you or by us.
• Request responses are erased when you close the request or when it expires; requests can stay open at most 365 days, for reusable forms.
• Records about squawks and requests (settings, access times and IP addresses, file names) are kept 12 months so senders can see who opened what, then deleted. Security and activity records are also kept 12 months, and web server logs 180 days.
• Backups are kept 90 days, then deleted.
• No advertising or tracking. Our pages load no third-party scripts, analytics, or trackers, and we don't sell or share your information for advertising.
• United States. Our servers are in the United States, and the service is offered only to US customers.
• Deleting your account in Settings immediately erases the squawks and requests you created.

Application security

• A strict Content Security Policy allows only our own scripts and styles, which blocks injected code. Pages also send protections against framing, content sniffing, and referrer leaks.
• Requests from other websites that try to act on your account are blocked.
• Sign-in, verification, and link-opening attempts are rate limited to stop guessing.
• Requests to customer-supplied addresses (webhooks, single sign-on discovery) are restricted to the public internet and checked at connection time, so they can't reach private networks.
• Squawk Boxes can accept items only from approved senders, who confirm their address with a one-time emailed code before they can send.
• Uploads are checked for dangerous file types. Downloads are delivered as files, never opened in the browser.

Account security

• Every account's email address is verified, and new sign-ups also verify a US mobile number.
• Two-step verification with an authenticator app, with one-time recovery codes. Business admins can require it for their whole team.
• Single sign-on with Microsoft 365, Google Workspace, or Okta on the Business plan, with company domains proven by DNS.
• Sessions end after 60 minutes of inactivity and 12 hours at most. Removing someone from a team signs them out immediately.
• An email alert whenever an account signs in from a new device.
• The optional Windows notifier connects with its own token, stored only as a fingerprint, that can fetch notifications and nothing else. Notifications never include secrets, and each computer can be disconnected in Settings.
• A detailed activity record of every view attempt, and security policies Business admins can enforce (required passphrases, maximum lifetimes, allowed recipients and networks).

Operations

• Encrypted nightly backups are stored with a separate provider from our servers.
• Administrative access to the platform is limited to named Inflight Technology LLC staff, and every administrative action is recorded.
• We review the application's security as features are added, and fix findings before release. Our most recent reviews were completed in September 2026.
• Software dependencies are kept to a minimum and checked for known vulnerabilities.

Subprocessors

These companies help us run Squawk Secret. None of them can read end-to-end encrypted squawks or request responses.

Company	What they do	Information they handle
IONOS	Server hosting (United States)	All service data, stored encrypted where described above
Wasabi	Backup storage	Nightly backups, encrypted before upload
Stripe	Payments and billing	Name, email, billing address, and payment card (card details go directly to Stripe)
Twilio	Mobile number verification	Mobile phone number
Microsoft	Email delivery; optional sign-in	Email addresses and the content of emails we send, such as verification codes and links you ask us to email
Google	Optional sign-in	Name and email address, for people who sign in with Google

Business customers who connect their own Okta organization for single sign-on use it under their own agreement with Okta.

Certifications and questionnaires

Squawk Secret does not currently hold SOC 2 or ISO 27001 certification, and we don't sign HIPAA Business Associate Agreements. We're glad to complete security questionnaires for business customers and to answer questions about anything on this page. Write to support@squawksecret.com.

Reporting a security problem

If you believe you've found a security vulnerability in Squawk Secret, please email security@squawksecret.com with the details and how to reproduce it. We'll acknowledge your report within 3 business days and keep you updated as we fix it.

We won't take legal action against good-faith research that:

• uses only your own accounts and test data, and never accesses, changes, or deletes other people's information;
• avoids degrading the service (no denial-of-service, spam, or automated scanning at high volume);
• doesn't use social engineering or physical attacks against us or our customers; and
• gives us reasonable time to fix the problem before anything is made public.

We don't currently offer paid rewards, but we're happy to credit researchers who report valid issues. Our contact details are also published in the standard security.txt file.