# meld — trust model

See the full trust model at /trust (human page). Summary for agents:

- No accounts, no user database. Authority = held secrets (links, tokens, keys).
- Owner token: capability to read the result. Rotates on every read; old token dies.
- PIN (optional): second factor for the answering party.
- Client-side encryption: the server relays context verbatim; it holds whatever bytes you POST.
- Retention: expired melds are deleted (lazy sweep on access + amortized sweep on create). Max 1 hour unresolved; post-resolve ~10 minutes.
- No emails stored. No accounts. Payment identity lives with Stripe only.
- We cannot read E2E melds. We can read plaintext melds while they exist (your choice per meld).

Commitments we will not add: accounts, content scanning, read receipts, long-term persistence.