Trust starts with what Social Media 2 refuses to do.

Encryption at rest

Private Constellation and profile state is encrypted at rest with PoP-derived keys, HSM-wrapped storage keys, and isolated match computation.

Security contact

Vulnerability reports route through RFC9116 security.txt and the public review packet.

Breach response

The 72h breach disclosure pledge is public: contain within one hour, disclose to affected citizens and authorities within 72 hours, and publish a post-mortem within 30 days.

Legal process transparency

Yearly subpoena and legal-process counts are published by jurisdiction with received, complied, rejected, and withdrawn totals.

Authentication

Passwordless sessions are bound to proof-of-personhood state and refreshed only through HttpOnly cookies.

Accessibility statement

WCAG 2.2 AA is the baseline for public, onboarding, and account surfaces.

Privacy policy

GDPR and CCPA rights are treated as product contracts, including a 24-hour deletion clause.

Business data policy

Payment, refund, dispute, tax, remittance, and admin audit records are minimized, access-controlled, and barred from matching or paid priority.

Private by default

Citizen state is not public by default, and public profiles are architecturally denied.

Deletion path

A citizen can exit with 24h deletion with signed receipt, preserving only anonymized aggregate counts.

Public evidence

Build and governance evidence is published without exposing private citizen data.

External review packet · Governance audit log

External pen-test status

Independent pen-test report status: no final external-firm report is ingested yet; the no-cost submission packet is tracked in the review evidence index.

Brand promise

Social Media 2 helps people find serious, welcoming, real-world opportunities to meet people and rejoin local life.

Anti-promise

Social Media 2 will not sell attention, rank people publicly, run ads, sell data, create paid matching priority, or keep someone scrolling.