What the service can and cannot see
The synchronisation service stores ciphertext. Every content field in the API contract is typed as opaque ciphertext and is stored, counted, sized and returned without ever being parsed. Content keys exist only on authorised client devices, so granting server-side membership does not grant decryption.
The metadata leak is documented rather than denied. An attacker who takes the database learns account identity, device identity and public keys, organisation and group membership, security-scope identifiers, key epochs, object identifiers, object types, revisions, sizes and timestamps — enough to infer how many hosts you have and when you work, but not what any of it says.
Four flows that stay separate
Account authentication, vault unlocking, device approval and host authentication are four independent flows. Signing in to an account does not unlock a vault; unlocking a vault does not authenticate you to a host; approving a device is a signed act performed by another device.
There is no universal recovery key, no developer bypass, no fixed encryption key, no silent unencrypted storage fallback, and no password-reset decryption backdoor. A password reset explicitly reports that the vault is unaffected, because it is.
Limitations that are not softened
A compromised unlocked endpoint can read and use the secrets available to it. Encryption protects data at rest and in transit from third parties; it cannot protect you from your own compromised computer.
Authorised recipients keep what they already decrypted. Revoking a member or rotating a key protects future content only; there is no recall. A brand-new device also cannot prove the server gave it the newest state, because rollback detection compares against a locally pinned checkpoint that a first sync does not have.
The protocol has not had an independent review. That review is a release gate, and it cannot be self-certified. Until it passes, nothing here is described as production-ready, and "uses encryption" is not "audited".
Source documents
This page summarises the files below. Read them for the full, authoritative text.
docs/security/THREAT_MODEL.md
Repository pathdocs/security/CRYPTO_PROTOCOL.md
Repository pathSECURITY.md
Repository path