Technical appendix

The trust page, with the engineering details left in.

This page is intentionally noindex. It is for technically skeptical readers and reviewers who want the implementation-level version of the public trust claims.

Runtime shape

The public marketing site is static HTML, CSS, and JavaScript. The app, API, recipient viewer, check-in links, exports, and status endpoints live on the app host. The current sandbox split is public site at sandbox.wordsabide.com and app/API at app-sandbox.wordsabide.com.

Storage and encryption

Media uploads are presigned S3 PUTs. When AWS_KMS_KEY_ID is configured, the upload includes ServerSideEncryption: aws:kms and SSEKMSKeyId. Export archives are uploaded the same way. Production settings require AWS_S3_BUCKET and AWS_KMS_KEY_ID, and production HTTPS redirects are enabled.

This is server-side encryption with AWS KMS plus HTTPS in production. It is not client-side encryption, and it is not a zero-knowledge design.

Exports

The export API creates an authenticated export job and requires a fresh sign-in. Completed archives are downloaded through owner-scoped, short-lived presigned links, not public URLs.

Recipient and check-in pages

Recipient viewer and check-in token pages set noindex headers and no-referrer policy. Delivered viewer tokens are designed for permanent re-access unless revoked, while pre-delivery preview tokens can have a finite TTL.

Release safeguards

The release sweep checks whether the owner checked in after the missed window opened. It then uses an atomic state change from active to releasing, tied to the observed deadline. If a check-in moves the deadline before that state change lands, the release is suppressed and audited.

Status and uptime

The backend has a shallow health endpoint and a gated deep health mode. It also has a public synthetic-release counter endpoint at /status/releases/, but that counter is feature-flagged off by default today. The public status-page provider is still an open launch decision, so the trust page does not claim a live uptime page yet.

Known launch gates

Wind-down reserve is planned but not claimed until it exists.
Dead-founder protocol is planned but not claimed until documented.
Law-enforcement and family-dispute language needs counsel review.
Staff-access wording must stay honest unless client-side or zero-knowledge encryption ships.