Privacy Verification & Evidence

Privacy Claims Backed by Evidence

SecurityNet is designed to minimise the information retained by its infrastructure. But privacy claims should not depend on trust alone.

We examine the production SecurityNet mediator environment, test how it behaves during real SecurityNet activity, and document what we find — including anything that needs to be changed.

The evidence below is based on testing of the live SecurityNet mediator infrastructure, not a laboratory simulation.

No SecurityNet Server Logs

SecurityNet does not create or retain application-level server logs of user communication activity.

During verification, we examined the mediator process, system logging paths and associated proxy logging. Historical application logging identified during the audit was disabled, and a subsequent live SecurityNet transfer produced no corresponding mediator activity records in the locations examined.

No SecurityNet Metadata Capture

SecurityNet is designed not to capture or retain metadata about user communication activity on the mediator.

During live verification, we completed a successful SecurityNet transfer and examined the relevant server logging and storage locations. No corresponding SecurityNet activity record, transferred file or temporary copy was found in the locations examined.

No Stored Copies

SecurityNet does not use the mediator as cloud storage. Files passing through the mediator are not retained there as stored copies.

During live verification, we completed a successful SecurityNet file transfer and then examined the mediator working directory and standard temporary storage locations. No transferred file, temporary copy or other transfer artefact was found.

Evidence: No SecurityNet Server Logs

Verification date: 23 August 2026

What we tested

A successful SecurityNet file transfer was performed between two devices using the live production mediator. Immediately afterwards, the server locations capable of recording mediator activity were examined.

What we checked

• Mediator system-journal output
• Current and retained system logs
• Caddy proxy access logging
• Mediator working directory
• Standard temporary storage locations

What we found

No corresponding SecurityNet mediator activity record was found in the logging locations examined. The historical Caddy access log remained unchanged following the transfer.

What the audit changed

Earlier investigation identified two application-related logging mechanisms: mediator diagnostic output entering the Linux system logging chain, and Caddy access logging. Both were disabled before the live verification test.

Result: PASSED

The live test produced no corresponding SecurityNet server activity log in the locations examined.

Verification Evidence

Mediator journal verification: Querying the mediator service journal from before the 23 August live transfer returns no entries. Current-state verification captured 24 August 2026.

Caddy access-log verification: The historical relay.log was accessed during verification on 23 August, but its contents have not been modified since 15 August 2026, when access logging was disabled. Current-state verification captured 24 August 2026.

Evidence: No SecurityNet Metadata Capture

Verification date: 23 August 2026

What we tested

A known SecurityNet file transfer was completed between two devices using the live production mediator. We then searched the relevant server locations for records that could identify or describe that communication activity.

What we checked

• Mediator activity output
• System journal and system logs
• Proxy access logging
• Firewall logging associated with mediator traffic
• Mediator and temporary storage locations

What we found

No corresponding SecurityNet communication record was found in the locations examined. We found no retained mediator activity identifying the transfer, participating devices or associated connection activity.

What the audit changed

Earlier investigation found that mediator diagnostic output and Caddy access logging could retain connection-related metadata. These logging mechanisms were disabled before the live verification test.

Result: PASSED

Following the live transfer, no corresponding SecurityNet communication metadata was found in the server logging and storage locations examined.

Verification Evidence

Firewall-log verification: Current and retained UFW logs were searched for traffic associated with the SecurityNet mediator port. No matching records were returned. Current-state verification captured 24 August 2026.

Mediator logging configuration: The production mediator service is explicitly configured with StandardOutput=null and StandardError=null, preventing its diagnostic output from being passed into the Linux system logging chain. Current-state verification captured 24 August 2026.