Security

Last reviewed: 2026-10-19

Translated from the Spanish original, which stays available: leer en español.

What the service does

Connections to this site, the app and the server are encrypted over HTTPS.
In the beta, only people with an invitation get in. The server checks the signature, issuer, email and expiry of every access.
Your conversation lives on your device. The server doesn’t keep transcripts: only the minimal technical state, with pseudonymous keys and expiry periods (see privacy).
If automatic deletion of expired data fails or falls behind, the server stops accepting new conversations until it’s working again.
Card details go straight to Stripe; Moritura never sees them. Payment notifications are only accepted if their signature is valid, and each one is processed once even if it arrives more than once.
Your account session in the web app is kept in memory only, not in browser storage.
Technical logs exclude passwords, tokens, authorisation headers and cookies.
Reading internal data in exceptional cases needs a signed authorisation for a specific reason and request, which expires and can’t be reused. Each access is logged for 90 days.

We haven’t had an independent audit or a penetration test, and we have no security certifications. No service is completely secure.

Reporting a vulnerability

Write to [email protected] with the subject “Security”. Tell us what you found, where, how to reproduce it and what impact you think it has. We’ll confirm we’ve received it within 2 working days at most.

Give us time to fix it before making it public, and we’ll agree with you when to talk about it. While you test, don’t access, change or delete other people’s data, don’t degrade the service and don’t use social engineering. Don’t send credentials, tokens or personal data that aren’t needed to understand the fault.

Incidents

There’s no public service status page. If an incident affects your personal data, we’ll notify the Spanish Data Protection Agency and let you know through whatever contact details we have, in the cases where the law requires it. We’ll tell you what we know and what we don’t know yet.