Thummer
Security & privacy

Encrypted at every step

A cargo passes through strangers' phones, so it has to be protected from the moment it's created. Here's how, in plain language.

Layers of protection

Device keys that never travel

When a rider registers, it and the cloud agree on a key using ML-KEM-768, a post-quantum key exchange standardised as FIPS 203. The key itself is never sent over the network, and the cloud stores its copy encrypted.

Encrypted from device to cloud

Every cargo is encrypted on the device with AES-256-GCM, strong enough to stay safe against future quantum computers. Drivers carry it but can't read it or change it unnoticed.

Sealed for the consumer (optional)

A consumer can publish a public key. Riders that have it seal the message with HPKE (X25519, AES-256-GCM) before the outer encryption, so only that consumer can open it, not Thummer.

To be clear: this inner layer uses classical X25519, not a post-quantum algorithm, because post-quantum ciphertexts don't fit in a Bluetooth-sized cargo. The post-quantum outer layer still protects every cargo.

Secure connections to the cloud

Drivers and apps reach the cloud over TLS 1.3, preferring the hybrid post-quantum key exchange X25519MLKEM768. Even over an older connection, the cargo inside is already encrypted end to end.

Receipts that can't be forged

Delivery receipts are signed with HMAC-SHA256 under a key only the rider and the cloud share. Drivers can carry receipts back but can't fake one.

Protection from abuse

Every rider, driver, consumer and account is authenticated. Message size and frequency are limited by account class, duplicates are recognised, and sign-in and sign-up attempts are rate limited.

Who can see what

  • Drivers see that a rider has cargo, and which consumer it's addressed to, but never its contents.
  • The Thummer cloud authenticates and routes every cargo. It reads the contents only when a rider sends without sealing.
  • Consumers read the messages addressed to them, and only those.

Your account

Passwords are stored as bcrypt hashes, and API keys as hashes or encrypted copies. Signing in is rate limited, and administrators can require a password change.

Create an account