SECURITY MODEL

What encryption protects - and what it doesn't

Vault documents are encrypted in your browser before upload. Recovery answers never leave the device that decrypts them. While you are signed in, Recivity stores an owner wrap secret so your vault can unlock without a separate passphrase - the owner path is account-assisted, not operator-proof.

What we cannot see

  • - Document and file plaintext
  • - Recovery answers (derived only in the beneficiary's browser after release)

What we can see or hold

  • - Account profile data (email, name, and related account fields)
  • - Encrypted vault ciphertext and file blobs
  • - Owner wrap secret (used to unlock while you are signed in)
  • - Wrapped DEKs, salts, IVs, and cryptoMeta
  • - Recovery question text (not answers)
  • - Beneficiary names, email addresses, and optional phone numbers
  • - Check-in timestamps and escalation / notification logs

Two unlock paths

Owner path

When you are signed in, your browser derives a key from the owner wrap secret stored with your vault, unwraps the vault DEK, and decrypts locally. Anyone with full database access can do the same for the owner path.

Beneficiary path

After the dead-man window closes and the vault is released, beneficiaries receive key material for the recovery wrap. If you set a recovery question, the answer is entered only in their browser. That path is end-to-end: we never receive the answer.

True today

AES-256-GCM

Documents and files are encrypted in the browser with a vault DEK. We store ciphertext and wrap material - not plaintext.

PBKDF2-SHA256

Owner wrap secrets and recovery answers are stretched with PBKDF2-SHA256 at 310,000 iterations before wrapping the DEK.

Beneficiary end-to-end

Release APIs never expose the owner wrap secret. Recovery answers stay on the beneficiary's device.

Plaintext never transmitted

Encrypt and decrypt run in Web Crypto on the client. Only ciphertext and metadata are sent to the server.

Planned

Planned: operator-proof owner unlock

Stop persisting the owner wrap secret so Recivity cannot decrypt the owner path even with database access. This will change signed-in unlock UX.

Planned: Argon2id key derivation

Migrate from PBKDF2 to Argon2id with a versioned cryptoMeta path for existing vaults.

Planned: vault export

Let you download encrypted vault contents and a standalone decryption page so the vault can outlive the service.

Read the crypto design doc