System Architecture
Zero-Knowledge Ephemeral Chat
SecureChat is a real-time communication platform engineered for operational security. No persistence, no accounts, no trace. When the room dies, everything dies with it.
Core Principles
What makes it different
Volatile Memory Only
No database. No file writes. All state is held in thread-safe Python dicts — gone on restart.
Realtime Pub/Sub
Serverless-native realtime delivery — no persistent server process holds your connection open.
Auto-Purge Lifecycle
Rooms self-destruct after 60 minutes. Empty rooms are garbage-collected immediately.
Zero Logs
No logs. No trace. No user tracking. All session tokens are generated per-visit.
EXIF Scrubbing
Images re-encoded through canvas, stripping GPS and device metadata.
Host Authority
Room creators hold full moderation power with auto host-promotion on disconnect.
Threat Model
What we protect against
- Server-side message interception — messages never written to persistent storage
- Identity tracking — no accounts, no cookies tied to identity
- Image metadata leakage — EXIF data stripped from all uploads
- Zombie rooms — hard 60-minute TTL enforced by the data store itself, not just app logic
- Server fingerprinting — werkzeug header masked to prevent version disclosure
System Limits
Operational boundaries
Max simultaneous rooms20
Max peers per room100
Room lifetime60 minutes
Message buffer per room300 messages
Max message length4,000 characters
Max file attachment4 MB
Host recovery window~60 seconds
Tech Stack
← Back to Home
Built with
Flask 3.1
Vercel Serverless
Upstash Redis (TTL state)
Ably (realtime pub/sub)
Flask-Talisman
Playfair Display
DM Sans / DM Mono
CSS Grid + Flexbox
Canvas API