Trust and security
No commercial payload byte and no payload key ever touches our servers. Under listing, signatures of files you chose to list do cross; nothing derived from an unlisted file ever does, and nothing that can reconstruct a listed file’s content is stored in the clear.
See what is built todayThe dashed line
Where things stay and where they go
Stays on your device
- Your files
- File names and paths
- Previews and private notes
- The vault itself
Crosses only when you choose
- Coarse facts about files you list
- Fingerprints that recognize copies
- Signed offers and receipts
Only if you turn listing on. Turning it off deletes it.
Goes straight to the buyer
- One encrypted unit, after you accept its license
- From your device to the buyer’s own storage
- We never hold it or its key
Diagram with three columns: your device, Mass Employment, and the buyer. Your files stay in the first column. Coarse facts cross to the second column only when you choose. An encrypted unit goes from the first column to the third and never passes through the second.
Read the complete boundary
Your files stay where they are. This tab (or the companion app) reads them to build a private index called your vault. Nothing derived from an unlisted file ever leaves. If you list a folder, coarse facts and fingerprints about its files go to Mass Employment so requests can find you. If you deliver work, it goes encrypted from your device to the buyer’s own storage. We never hold it and never hold the key.
Published keys
Devices verify what we sign, offline, against the keys we publish. A device that cannot verify uploads nothing.
/.well-known/massemployment-keys.json
Setup required The endpoint fails closed until the production key ceremony publishes the first trusted keys.
What we never do
- No face recognition. Refused, not deferred.
- We never hold a commercial payload byte or a payload key.
- We never compute or show a count of hidden matches.
- We never store anything about health, faith, sexuality, immigration or children.
- We never pay differently for who a person is.
What is built today
As of 1 September 2026.
Each capability reports whether its code is built and whether its production setup is complete.
| Capability | Status | What that means |
|---|---|---|
| Public site and control plane | Live | Site, APIs and operational checks are running. |
| Private folder browser demo | Working locally | The browser-local try flow works without an account; this is not paid work. |
| Signing keys | Pending | The public endpoint is live, but the production key ceremony has not run. |
| Offsite recovery | Pending evidence | No offsite replica and restore drill is evidenced yet. |
| Listing, buyer market and delivery | Access restricted | The workflow is implemented but remains unavailable without exact release and funded-call evidence. |
We have not had a third-party security test yet. We will say so here when we have.
Report a problem
Write to security@massemployment.com. There is no bug bounty yet, and we say so rather than imply one.