Browser application layer
The public site and live application are separate concerns. The browser application contains the identity, messaging, media and call modules that perform client-side cryptographic operations and interact with authenticated service endpoints.
Cryptographic layer
Supported private messaging uses ECDSA P-256 for signatures, ECDH P-256 for shared-key derivation, HKDF-SHA256 for key derivation and AES-256-GCM for authenticated encryption. The server does not need private-message plaintext to relay the protected envelope.
Authentication layer
Durable sessions are represented server-side and checked against expiry, account state, identity and public-key consistency. Challenge-based authentication uses single-use challenges and proof of possession.
Media transfer layer
Encrypted files use chunked transfer, transfer descriptors, quotas, expiry, authenticated access and separate storage classes. Workspace can keep saved files out of the ordinary chat publication path.
Calling layer
WebRTC handles encrypted media transport while application signalling coordinates call setup. ICE uses STUN and TURN infrastructure to find a viable path when direct connectivity is not available.
Community and commercial layers
Forum, Marketplace and billing add dedicated product workflows with their own access, transaction and operational controls.
Administrative security
The administrative control plane uses a separate authentication boundary, CSRF protection, login limiting, encrypted settings and access controls. Administrative capabilities should remain isolated from ordinary user workflows.