Sona security
Built to stay safe for a lifetime, even against a quantum computer
Security is part of Sona’s architecture from the start. Our controls are designed for long-term protection and are documented below.
What "quantum-safe" means, in plain English
Large-scale quantum computers could break widely used public-key algorithms. Sona is planning for that risk in its long-term storage design. NIST finalized new post-quantum standards in 2024 for exactly this reason. Meanwhile, bad actors already work on a "harvest now, decrypt later" basis: stealing encrypted data today so they can open it once the technology exists.
Your twin is the most personal data you will ever create, and you intend to keep it for a lifetime. So we lock it with encryption built specifically to resist quantum attacks: post-quantum algorithms designed to resist known quantum attacks.
How the Sona Vault actually works
Sona Vault.
The post-quantum safe for your persona, built on NIST-standardized post-quantum algorithms, used where appropriate. ML-KEM (formerly Kyber) for key encapsulation, ML-DSA (formerly Dilithium) for signatures, and SLH-DSA (formerly SPHINCS+) as a second signature scheme on completely different mathematics, so a break in one does not take the other with it. Key-management details should state where keys are generated, stored, recovered, and revoked.
Defense in depth.
Post-quantum cryptography sits alongside strong conventional encryption in transit (TLS) and at rest, plus data isolation between tenants and accounts. We are applying the standards built for exactly this threat now, rather than after old encryption becomes a liability.
Signed Persona: provenance and anti-deepfake.
Supported twin output carries provenance data that identifies its source and AI-generated status. Provenance signals can help recipients verify that content came from a Sona twin. In a world filling up with deepfakes, that signal is what helps make a fake detectable.
Privacy Edge.
The sensitive parts run on your device where possible: wake-word detection and a local persona cache. Privacy controls are implemented in the product architecture and described in the policy.
Beyond encryption: the Trust Layer
Kill Switch.
Full export and irreversible deletion of your twin in one tap, always free. The deletion control should be easy to find. Its description must state the scope and completion time.
Consent Registry.
A twin can only be created by the verified person it represents. The registry records who may do what with it and on what terms, and you can revoke any of it in one tap.
Continuation Plan.
The owner sets the rules for access and the twin's future status. Triggers, verification, and family governance are all set in advance by them.
Anti-Dependency Design.
The twin points you back to living people and a living life. Sona presents the twin as an AI model and encourages users to maintain contact with real people.
Compliance documentation.
GDPR, CCPA, and EU AI Act aligned, with clear AI labeling. Legal review before launch in each market.
Security FAQ
- What does post-quantum security protect against?
- It protects against attacks from future quantum computers, which could break much of today's encryption. Sona uses it to protect your twin for the long term.
- Is my twin protected against quantum attacks?
- Sona Vault uses all three NIST-standardized post-quantum algorithms (ML-KEM, ML-DSA, and SLH-DSA) together with strong conventional encryption. That is the current state of the art for long-term data protection, and we will move as the standards move.
- What prevents unauthorized impersonation?
- Sona verifies identity and requires explicit permission. AI disclosure and provenance signals help recipients assess the source. No control can eliminate misuse entirely.
- What happens to my twin if I die?
- Nothing you did not choose. Inheritance only happens on terms you set in advance, with verification built in. If you set no terms, nothing opens to anyone.
Become the second version of yourself
Join the waitlist to build your Sona twin when access opens. You will control the twin and the data used to create it.