Security

Backstop’s differentiator is not “we promise not to look.” It’s that the decisions that matter — what counts as harm, who sees the alerts, whether anyone else can read them — sit with you, not with us. This page describes how the architecture makes that a property of the code, not a policy commitment.

The trust model

Backstop has three physical places where code runs: your child’s laptop (the endpoint), your browser (the parent PWA), and our servers (the control plane). Content flows between the endpoint and your PWA. The control plane in the middle is a ciphertext relay — it stores and forwards opaque bytes.

What the control plane can see:

• Your account email and a Firebase Auth user id. Password storage is Firebase’s; our servers never see your password.
• Which endpoints belong to your family and when they were last online.
• The size and timing of each alert.
• The delivery channel and destination you asked us to route to (e.g. a phone number or a browser push subscription).
• A coarse two-bit severity bucket (0 = “notify eventually,” 1 = “notify now”) so routing rules can pick the right channel.

What the control plane cannot see:

• Screenshots. They never leave your child’s laptop.
• Your BYOK LLM provider API key. It lives in your endpoint’s OS keychain.
• Full LLM responses. Only the fields needed for an alert get packaged, and even those are encrypted before we see them.
• Alert content. The one-sentence summary and triggered categories are encrypted before they reach us.
• Your harms taxonomy and blocklists. Encrypted before we see them.

Cryptographic primitives

Both sides — the endpoint (Rust) and the parent PWA (browser) — speak the same wire format directly.

• X25519 for elliptic-curve key agreement.
• ChaCha20-Poly1305 for authenticated symmetric encryption.
• HKDF-SHA256 for key derivation.
• BLAKE3 where hashing is called for.
• PBKDF2-HMAC-SHA256 (210,000 iterations) for the client-side wrap key that guards the family key at rest.
• Password hashing (scrypt) is handled by Firebase Auth — our servers never see the password or the hash.

Additional authenticated data (AAD) on every encrypted record includes the record’s primary identifier (alert_id, config_version, etc.) to prevent ciphertext-substitution attacks.

The family key

Every family has one long-lived symmetric family key.

• Generated in your browser at signup, using the platform’s cryptographically secure random source. It is never sent to us in plaintext.
• Stored at rest in your browser’s IndexedDB, wrapped under a key derived from your login credentials via PBKDF2-HMAC-SHA256. Held in memory only while the PWA is open.
• Backed up via a 24-word BIP-39 mnemonic phrase shown once at signup.
• Delivered to enrolled endpoints via a short-lived pairing code shown in the parent app during install, so that endpoints can decrypt configuration and encrypt outgoing alerts to you.

If you lose all of your devices and your mnemonic, we cannot recover your data. That is by design. It’s the same trade-off Signal and iMessage make.

Alert delivery under E2EE

When an endpoint fires an alert, it encrypts the content under your family key and hands the ciphertext to the control plane. Your PWA fetches it and decrypts locally.

The PWA is where alerts land today. Push, SMS, and email notifications of new alerts are rolling out — each is a content-free ping to the channel you configured; the full alert body is only visible after the PWA decrypts it.

Endpoint scope

The endpoint runs in the child’s own user session for screen capture and uses a helper process for privileged operations. Its update client verifies signatures against a manifest signed by our Ed25519 release key.

Two things it deliberately does NOT do:

• Hide. The endpoint user can see the process, the Start Menu shortcut (on Windows), the enrollment wizard. Backstop asserts itself when installed and does not sneak around after that.
• Resist tampering. A technical kid can turn the machine off, use a different device, or terminate the helper. We could try to make Backstop harder to defeat — Protected Process Light, ELAM-signed anti-malware manifest, etc. — but chasing tamper-resistance on hardware the auditee owns is anti-cheat’s losing game. Backstop is a tool a parent uses, not a cage that binds a kid.

Vulnerability disclosure

Please report anything you find to security@backstop.family. Our disclosure policy is also published at

/.well-known/security.txt per RFC 9116.

What we still see (being honest)

We do see metadata: your email, when your endpoints are online, how often they send alerts, the size of each alert, and the delivery routes you chose. That metadata is enough for someone with legal process to learn things about your family’s use of Backstop, even though they cannot learn the content of any alert or rule. We think that’s the right trade-off for a product that has to reliably deliver notifications.

For the full inventory of what a subpoena to Backstop would return — and what doesn’t exist on our servers to hand over — see what we can hand over on subpoena.