# Security

> Exactly what Weald can see and what it cannot. Encryption boundaries, what the relay stores, and the metadata that a hosted service cannot avoid.

Source: https://getweald.com/security
Last modified: 2026-08-20

---

## What we see

## Encrypted project data

Members hold keys. Relays cannot read content.

*Choose who operates the relay*

| Mode | Control | Cost |
| --- | --- | --- |
| Self-host | You operate | Free |
| Hosted | We operate | Storage only |

Self-host · Hosted

## What we see

Relay operators can still see envelope sizes, timing and connection patterns.

A member device has plaintext on it. A lost device breaks the boundary.

Anything an agent sends to a model provider is outside the Weald boundary.

*The trust boundary, as a table*

| We see | We cannot see |
| --- | --- |
| Envelope sizes and timing | Message bodies |
| Connection counts and addresses | Ticket text and titles |
| Storage totals per workspace | Media, filenames, channel names |
| Billing account and email | Workspace member lists |

## The practical result

Hosted updates without readable project data.