How it works

Four steps, none of which happen on our server

Sealing a document is a chain of standard, boring cryptography. Boring is the point: every piece here is a published primitive your own auditor already knows how to check.

Step 1 · Seal

The document is encrypted before it is addressed

Your browser generates a random 256-bit content encryption key and encrypts the file with AES-256-GCM. The filename, the file type and the real size go inside that encrypted payload, which is why the envelope never carries them.

Step 2 · Address

One wrapped copy of the key per recipient

For each recipient, an ephemeral ECDH P-256 exchange against their published key derives a shared secret through HKDF-SHA256, which wraps the content key with AES-KW. Only the matching private key can unwrap it, and that key never left the recipient's device.

Step 3 · Bind

The metadata is tied to the ciphertext

Retention terms, policy and the recipient list are fed into the cipher as additional authenticated data, over a canonical serialization of the JSON. Editing any of them invalidates the file rather than silently downgrading it — and reformatting the JSON does not break verification.

Step 4 · Open

Decryption happens in the recipient's tab

The recipient's browser unwraps the content key and decrypts the payload locally. A server that relayed the file saw ciphertext on the way in and ciphertext on the way out.

Access methods

Three ways to hold a key

Chosen per recipient, and mixable within one document.

Published key

A keypair generated in your browser; the public half is published to the directory so anyone can encrypt to you without asking first.

Passphrase

Derived with PBKDF2-SHA256 at 600,000 iterations. No key to distribute — useful when the recipient is someone you can phone.

Hardware key

A YubiKey 5 or another FIDO2 authenticator, using the PRF extension. The secret is generated on the device and cannot be exported.

Quorum

When one signature isn't enough

Access can be split with Shamir secret sharing, so a document requires k of n holders to reconstruct the key. Set k equal to n and every named party must be present.

Any-of

Reachable by whoever is available

Each recipient gets an independently wrapped key. Useful for a shared intake address where any duty officer should be able to open a submission.

k-of-n

Deliberately hard to open alone

No single holder — including the sender, and including us — can reconstruct the key. This is the control that makes a fraudulent wire instruction fail on its own terms.

Verify it

What to hand your auditor

The normative spec

Every field, every algorithm and every version gate, written to be implemented against.

A verifier that shares no code

Written from the specification alone, so agreement between it and the product means something.

On-chain timestamps

The published bytes are anchored in the Bitcoin blockchain; the anchor breaks if a byte changes.

Read the specification