Security and your data

How we protect your Charta.

Charta holds the rules that decide what software may spend in your name. This page says what protects them, what we keep, and what we never have, in plain words.

What Charta is, and isn't

Charta decides whether a payment an agent asks for is within your rules, and records that decision. It is not a bank, a payment institution or a wallet: it never holds money, and it keeps no card numbers. When real payments start, your bank or card provider will move the money, after Charta has answered.

Who can approve what

Zillq Charta is two things that play well together. Your account proves who you are. The consent platform decides what your agents may do in your name and keeps the evidence. An email and a password are the minimum and the default: they create the account, and they are enough to use Charta. How strong your account is, is your choice, and the platform records honestly which proof stood behind each approval.

"Entered again just now" means within the last five minutes, at the account service, for exactly the thing you are approving. A confirmation for one payment can't be reused for another. These are the early-access limits, the same for everyone; your own rules can only make them stricter. Your Charta shows the limits that apply to you under Security & identity, read from the code that enforces them.

What a PIN is, and how it is recovered

A PIN is six digits you choose, in your Charta, not at the account service. Once you set one, your password no longer confirms approvals: only the PIN does, so a stolen password can sign in but cannot approve anything. It is kept scrambled, mixed with a secret held apart from your data, so a copy of the data alone does not reveal it. Five wrong tries in a row lock it for 15 minutes, ten lock it until you recover it, and PINs like 123456 are refused.

Setting a PIN shows a twelve-word recovery phrase, once. With it you choose a new PIN and get a new phrase. Without it, you can ask for a reset, which completes after 72 hours: your PIN keeps working meanwhile, every address and number you proved is told, you can cancel in the app, and using the right PIN cancels it. Whoever controls your email could ask for that reset and read the notice, so a security key remains the stronger choice.

If you forget your password

On the sign-in page choose Forgot your password?. We email a link, good for 15 minutes, to the address of your account. Resetting your password does not touch your PIN.

What a password confirmation is, and isn't

When your account confirms something, the account service attests it, bound to the exact terms, and Charta records it as an account confirmation, never as a signature. It is not a signature: nobody can verify it without this deployment's secret, and whoever holds that secret, and whoever has your password, can produce it. That is the honest meaning of a password: it is as strong as the password you chose and how you keep it, which is your responsibility, not ours.

What adding a security key changes

Once you add a security key, your account's confirmation is no longer accepted for approvals. Choosing something stronger is binding for your own account, so a stolen password can sign in, but it can't loosen your rules, connect an agent or approve a payment. What the key signs is the exact text: for rules, the rules and their fingerprint, not the sentences Charta shows you; for a payment, its amount, payee and reference. A signature can't be reused for anything else, and anyone can verify it.

Which keys are accepted

As your security key: any FIDO2 security key, such as YubiKey or TOKEN2, plugged into your computer or phone, or held to it over NFC. A passkey kept in a phone or password-manager account can't be your security key, because it can be copied to your other devices. The key itself reports whether it can be copied, and Charta checks.

As a device's confirmation: the fingerprint, face or PIN of a phone or computer, including a passkey kept in an account. For a person with a security key it can do only what the table gives a device's confirmation: making things stricter, and approving smaller payments.

Proofs of who you are, and what each is worth

Your Charta belongs to you, not to an email address. You show it's you with several proofs, each of a different kind, and each with its own strength. The more independent kinds you add, the stronger your Charta.

After a password, Charta asks for the strongest other proof you set up. Your journal shows every sign-in, change to your identity, signature and payment, with the proof that was used and its strength. An address or a number proves one person: it can't be linked to two Chartas.

Your agents say whom they act for without saying who: a code for you that only Charta can link back to you, your trust level, and which kinds of proof stand behind it. Never your name, addresses, numbers or keys.

What is weaker than it looks

Zillq Charta is an early-access sandbox, and some of what we found while testing is weaker than its words might suggest. We say so here and, where it matters, in the app under Known limits.

• A software key can pass as a security key. Charta accepts any FIDO2 authenticator that signs correctly and does not say it can be copied. It does not check attestation, the proof of which make and model a key is, so a software authenticator (a browser's virtual one, or a program imitating a key) is accepted. Use a hardware key you hold, on a computer you control.
• A password or PIN confirmation is not a signature. Nobody can verify it without our secret, and whoever holds that secret could produce one. A security key's signature can be verified by anyone.
• Some backends are emulators. Mambu Payments runs as Charta's own copy of Mambu's documented behaviour; Mambu's real sandbox needs a key we do not have, and no payment has reached it. Each backend in the app says what is real, what is simulated, and whether each claim was measured, read or not run.
• Every payment is a test payment, on every backend. The sandbox accounts are shared, and on one backend the person who approves at the bank's page is a public demo identity.
• The address on an account is not verified at sign-up, and texts reach only a few numbers while SMS is in its provider's test phase.
• It has not been independently audited.

You can change your backend only when the payments at the current one are settled. The app lists each unsettled payment with the way out.

Your data

What we keep

• Your account: your name and email address, from the account you create.
• Your proofs: the email addresses and phone numbers you prove, and your authenticator app's secret, stored sealed (encrypted). Codes we send are kept only in a form that can't be turned back into the code.
• Your Charta: each version of your rules with your signature, the public half of each key you add, your agents' names and public keys, their mandates, every payment decision, and the record that links them.
• Your settings: whether we may email you, and how long a payment may wait for you.

Where

On a server in the EU: Amazon Web Services, Milan region. Each person's Charta is a separate database, so a request about one person never reads another's.

What we never have

• The private half of your keys. It never leaves the key.
• The private key of any agent you connect. Your agent makes its own and keeps it. (The practice agent's key is held by Charta, by design, and it can only make test payments.)
• Card numbers, bank passwords or online-banking logins.

Who can see it

You, through your Charta. Like any hosted service, ZILLQ's operators can reach the server that runs it. Nothing on it can produce your security key's signature. It does hold the secret that makes an account confirmation, so with only a password you are trusting ZILLQ's operators not to use it; add a security key and that stops mattering, because your account's confirmation is then no longer accepted.

Taking it with you, or deleting it

You can export everything at any time under Proof, as one file with its signatures. To have your Charta deleted, write to hello@zillq.com from your account's email address.

Drafting with AI

When you ask Charta to draft rules from your words, the words you type, and the rules you are changing, are sent to Amazon Bedrock in the EU. Nothing about your payments, your agents or your keys is sent. Checking, trying and running your rules happen in Charta, without a model, and the plain-language version is written from the rules themselves. You can always write and check rules by hand instead.

Cookies and logs

• Your Charta sets two cookies, only for its own address: one while you sign in (ten minutes) and one for your session (eight hours). Both are unreadable to scripts.
• The sign-in service sets its own cookies while you sign in.
• Your choice of light or dark theme is kept in your browser.
• No advertising, analytics or other third-party scripts run in Charta, and these pages load no fonts or scripts from elsewhere.
• To run the service, each request to these pages is logged: the time, the page, the browser and its language, the site that linked here, and the network address.

How it is built

• Your rules run in a sandboxed rule engine that can only read the facts of the payment and your own spending: no files, no network, no clock of its own.
• Every decision is recorded in a chain where each entry commits to the one before it, so a missing or altered entry shows.
• Charta's pages are served under a strict content security policy: only Charta's own code runs on them.
• More than two thousand automated tests run before every release, including browser tests that sign with a virtual security key and accessibility audits of every page.

Availability

Early access runs on one server in the EU, which rests at night from 23:00 Malta time. Opening Charta wakes it; it's back in about a minute. Payments that wait for you while it rests are refused when their time runs out, never approved.

Reporting a problem

If you find a security problem, write to hello@zillq.com with “Security” in the subject. Please don't make it public until it is fixed. Tell us what you did, what you expected and what happened.