We Label Every Security Claim on Our Site: Implemented, Experimental, or Not Claimed

VEIL — Mon, 21 Sep 2026 02:21:37 +0000

Somewhere in the last decade, "end-to-end encrypted" stopped meaning anything.

Every messenger says it. Signal says it and has been independently audited for a decade. Telegram says it while it's off by default. WhatsApp says it and shares your social graph with Meta. When every product makes the same claim, the claim carries no information — and the audience that matters most (security researchers, privacy communities, journalists) has learned to treat the phrase as marketing until proven otherwise.

I'm a solo founder building VEIL, a zero-knowledge messenger in open iOS beta. When I sat down to write the landing page, I faced the same temptation every founder faces: list every impressive-sounding capability in the most impressive-sounding order. The problem is that some of our claims rest on shipped, tested code; some rest on designs we've implemented but haven't hardened; and one very important row — independent security audits — rests on nothing at all yet.

So we did something that felt commercially reckless: we labelled every single claim on the site as one of three things.

The three labels

Implemented — it's in the current build, testable by anyone who installs. Our burn-after-open messages, either-side kill switch, encrypted vaults with hidden volumes, duress and decoy codes, steganography — all labelled Implemented because they're in the shipping beta right now.

Experimental — designed, partially implemented, or implemented but not battle-tested. We'd rather you know which things to poke at than discover it yourself in a thread.

Not claimed — the label we reserve for things we deliberately don't say. We don't claim protection against a compromised endpoint. We don't claim our ratchet is equivalent to Signal's — it's custom, self-reviewed, and not independently audited. And we don't claim anonymity against a global passive adversary, because the cover traffic we do have doesn't support that claim yet.

What the labels cost us

Honestly? Some punch. "Independently audited" converts better than "50+ internal security reviews, automated test cycles and AI-assisted adversarial assessments — no independent audit completed." That's a real row on our public scorecard.

Our comparison table ranks Signal above us — 9.17 to 7.50 — largely because of the audit gap. We publish that on our own landing page. A normal marketing team would never.

What the labels buy

Every audience we care about is adversarial by default. Hacker News commenters will scroll straight to your cryptography page to check whether you're bluffing. r/cryptography will find the one claim you overstated and make it the headline. Security journalists keep a mental list of companies whose claims didn't survive contact with reality.

Labelling is pre-empting that. Nobody can catch us overstating if the overstatement is already on the page, labelled, in our own words. The strongest possible position in a community that lives on catching marketing in the act is: nothing to catch.

There's a second-order effect nobody warned us about: writing the labels forced engineering honesty on us. You can't label a feature Implemented while its test suite is red. The claims register became a public-facing spec — the site can't drift from the code without the label becoming a lie.

The audit gap, out loud

Since we're labelling things: Audits — Not claimed (yet). Our protocol — a custom double ratchet with an ML-KEM-768 hybrid handshake, sealed-sender credentials, and hidden-volume vaults — is self-reviewed. That's a real limitation, stated plainly. We're pursuing independent academic review now, and when it lands (whatever it finds — publication of criticism included) the label changes.

That's the whole bet: make claims you can defend at the moment someone asks, and label the rest.

Come break it

If you're the kind of person who reads labels like these looking for what's hiding underneath them — good. That's who we built this for. We're putting our money where the labels are: a public "Encrypt This" challenge with a US$1,000 bounty for anyone who breaks our published scheme, launching this week on Hacker News and r/cryptography.

Every claim, every label, every honest scorecard: https://tryveil.app/architecture
Open iOS beta (1,000 founding members, then waitlist): https://tryveil.app/landing