What this protects, and what it doesn't.
Written to be read before you trust it, not after something goes wrong.
What the server can see
Filenames and file contents are encrypted on your device. The server holds ciphertext and, for names, a keyed fingerprint it cannot reverse. It does see everything it needs to hand you the right file:
- How your folders are arranged, and how many files are in them
- The size of each file and when it changed
- The level and compartments each file carries — this is what it enforces
- Which people hold a key for which level
Someone who could watch that metadata over time could learn something about how you work, even without reading a single file. We would rather say so than let you find out later.
Two independent walls
Levels are enforced twice, by mechanisms that fail differently. The database refuses to hand over a file your level does not reach. Separately, the key that opens a file is wrapped to that file's level, so a stolen backup is no more readable than the live system. A mistake in one does not undo the other.
The web app's honest limit
This site's code is delivered by the same host that stores your files. A host that had been compromised, or compelled, could serve a modified page that copies your keys as you type your passphrase. No amount of encryption inside the page fixes that, because the page itself is the thing in question.
So the claim we make is that files are encrypted in your browser before upload — not that we could never read them. A signed app, installed once and updated deliberately, is what would let us say the stronger thing. There isn't one yet.
Recovery, and its price
You get a recovery code when you sign up. It wraps the same key your passphrase does, so either one gets you in, and neither reveals the other. It is shown once and never stored, so we cannot resend it. Using it sets a new passphrase and issues a fresh code; the old one stops working.
If both are lost, your files stay sealed forever. There is no reset link, because a reset link would be a way in that we control — and then we would be able to read your files, which is the thing we are trying not to be able to do.
What is not covered
- Your own device. Keys are made where you type. Malware there defeats all of this.
- Withdrawing access. Removing someone's clearance stops the server serving them new files, but someone who already held a key keeps it until that level's key is rotated and its files re-encrypted.
- Traffic analysis against the metadata listed above.
- Availability. There is no rate limiting or denial-of-service protection yet.
No outside audit yet
The code is open, the design is published, and the encryption engine is tested in both directions against its own specification. A paid review by a security firm is a different kind of assurance and has not happened.
Reporting something
Please email security@extant2000.com rather than opening a public issue, if what you have found is exploitable.