Post

@capacities.bsky.social - care to spare a minute about Data Protection / Privacy? I'm curious, in your Data Protection Memo you state "We strictly protect all your data against any access from third parties." which you do by saving data on "encrypted discs" which in practice is... 🧵[1/3] #pkm

Heals

@heals.codes

.. no protection at all from any unauthorised use by a third party that somehow got access to the running system (unless Capacities encrypts the data it writes to disc). An encrypted disc is only secure at rest / while unmounted. Could you elaborate on the means of encryption employed? 🧵[2/3]

4/8/25, 12:35 pm0 reposts1 like

Heals

@heals.codes

4 Aug 2025

There's also the topic of "we have no interest to access your data [even though we technically could]" - not sure if that is meant to reassure anyone? Policy is all nice and well but how is it enforced? What if there's a data breach - those people surely don't abide by policy? 🧵[3/3]

Capacities

@capacities.bsky.social

5 Aug 2025

Everything about data protection is here: docs.capacities.io/more/data-pr... If you want updates to be made to the document, you can send us an email.

Capacities

@capacities.bsky.social

5 Aug 2025

About your questions: Yes, encryption is at rest. If you're asking about E2E encryption which would enforce it, here's our statement on this: docs.capacities.io/more/end-to-.... If there's no E2E encryption, policies and good systems are the only option, it cannot be "enforced". We hope that helps

Heals

@heals.codes

5 Aug 2025

I’m not talking about E2EE - I read your statement on that. I’m talking about basic data security on-storage. Things like “data is encrypted inside our databases, Capacities can decrypt it based on a users login credentials or similar information only we and the user know”.