Skip to content

Trust Stack

Most privacy companies ask you to trust their word. Brivora eliminates the need for trust entirely.

Status Overview
01 Open Source Code Live
02 Reproducible Builds In Progress
03 Independent Security Audits Planned
04 On-Chain Financials Planned
05 Warrant Canary Planned
06 Zero-Knowledge Architecture In Progress
07 Tor Accessibility Planned
08 Community-Verified Deployments Planned
09 Formal Verification Planned
10 On-Chain Public Record In Progress
Layer 1 Live

Open Source Code

You can read what we run.

Every line of Brivora code is public under AGPL v3. Every package, every service, every tool — open source. Not "open core" where the good parts are hidden behind a paywall. Not "source available" where you can look but not use. Fully open source, with a license that guarantees it stays that way.

AGPL v3 means that if anyone takes Brivora code and builds a service with it, they must release their modifications under the same license. The code stays free. Forever. Even if Brivora disappears tomorrow, the code belongs to everyone.

Status: LIVE

View evidence ->
Layer 2 In Progress

Reproducible Builds

You can verify deployed code matches source.

Open source means you can read the code. Reproducible builds mean you can verify that the code you read is the code that's running. Nix-based build system ensures anyone can build from source and compare hashes. Deployed binaries are cryptographically linked to source commits.

This closes the gap between "the code is open" and "the software I'm running is actually that code."

Status: IN PROGRESS — npm packages published. Nix reproducible builds not yet configured.

Layer 3 Planned

Independent Security Audits

Independent experts verified our claims.

We don't just say the cryptography is correct — we pay independent security firms to prove it. Full audit reports published on-chain. Not summaries. Not redacted versions. The complete report.

First audit to be commissioned with grant funding. Targeting Cure53, Trail of Bits, or NCC Group.

Status: PLANNED

Layer 4 Planned

On-Chain Financials

No hidden revenue from your data.

All revenue flows through crypto rails. Public treasury wallet viewable on-chain. Live dashboard showing every dollar in, every dollar out. Published costs, margins, and founder compensation.

If it's not on-chain, it doesn't exist. There is no second set of books. There is no hidden revenue stream from monetizing your data. The math proves it.

Status: PLANNED — Treasury wallet not yet established.

Layer 5 Planned

Warrant Canary

No secret government orders.

Monthly cryptographically signed statement, published on-chain. If the canary stops, you know why. This is the only protection against National Security Letters and similar legal gag orders — you can't say you received one, but you can stop saying you haven't.

Status: PLANNED — PGP key generation pending.

Layer 6 In Progress

Zero-Knowledge Architecture

We mathematically CANNOT access your data.

End-to-end encryption on everything. User generates key pairs locally — private keys never leave the device. Brivora has no master keys, no backdoors, no recovery mechanism.

If you lose your key, your data is gone forever. That's the price of real privacy, and we will never compromise it. "Can't" is stronger than "won't." We chose "can't."

Status: IN PROGRESS — PQC crypto shipped. E2E sync not yet built.

Layer 7 Planned

Tor Accessibility

We don't even know your IP address.

.onion mirrors for all Brivora sites. Sync accessible over Tor. Install packages from censored countries. Brivora serves everyone — including people whose governments don't want them to have it.

Status: PLANNED — .onion mirrors not yet deployed.

Layer 8 Planned

Community-Verified Deployments

Hundreds of people ARE verifying, constantly.

Decentralized build verification network. Community members independently build, hash, and compare binaries. If even one verifier finds a discrepancy, it's public immediately. Goes beyond "you CAN verify" to "people ARE verifying."

Status: PLANNED — Requires community growth first.

Layer 9 Planned

Formal Verification

A mathematical theorem proves it's impossible.

Mathematical proof that the code correctly implements privacy properties. Not just audited. Not just tested. Proven. The kind of claim cited in academic papers and government policy documents.

Status: PLANNED — Requires academic collaboration.

Layer 10 In Progress

On-Chain Public Record

Every word we've ever said is permanent and verifiable.

All public statements signed with PGP and published to Arweave. Blog posts, announcements, pricing changes, policy changes — permanent, verifiable, uneditable. Companies stealth-edit and delete. Brivora literally cannot.

Status: IN PROGRESS — Arweave pipeline specced, not yet deployed.

Comparison

Company Layers Which Ones
Most tech companies 1-2 Open source + maybe an audit
Signal 4 Open source, audits, warrant canary, ZK architecture
Mullvad 3 Open source, warrant canary, Tor
Proton 4 Open source, audits, warrant canary, ZK architecture
Brivora 10 All of them. 10 designed, building toward all.
"I want something so solid that people don't even have to trust Brivora or me at all. If they trust themselves and math, that should be more than enough."
— Oscar Hughes, Founder
Read the Guarantee -> Track Trust Stack progress ->