Security
Flint Cloud is designed so that a compromised server, a compromised storage account or a stolen database dump does not expose your files. This page describes the model as designed, and where it stops.
Primitives
All cryptography uses libsodium (libsodium-wrappers-sumo on the web, lazysodium-android on Android). The web app and the Android app must produce byte-identical formats, checked against shared test vectors.
| Purpose | Primitive |
|---|---|
| Password to key | Argon2id (moderate limits; interactive on weak devices; parameters stored with the wrapped key) |
| File content | XChaCha20-Poly1305 secretstream, 4 MiB plaintext chunks |
| Key wrapping and metadata | XSalsa20-Poly1305 secretbox |
| Sealed uploads from CI | X25519 sealed boxes (crypto_box_seal) |
| Login proof | BLAKE2b keyed with the password key |
| Recovery key | 32 random bytes, shown as 24 BIP39 English words |
Keys
- Master key (MK): 32 random bytes generated on your device when the vault is created. It never leaves a device unwrapped.
- Password key (PK): derived from your password with Argon2id and a random salt. The server never receives your password or PK.
- Recovery key (RK): 32 random bytes, shown once as 24 words.
- The server stores MK wrapped twice, once under PK and once under RK, plus the salt and KDF parameters. For vault unlock it also stores a BLAKE2b hash derived from PK, used as a second factor.
- File key (FK): a fresh random key per file, stored wrapped under MK.
Files and metadata
Each file is encrypted with its own FK using secretstream in 4 MiB chunks. Each chunk becomes one storage block, so an interrupted upload resumes at the last chunk. The 24-byte stream header is stored with the file record.
File name, type, size, modified time and thumbnail key are a JSON blob encrypted under FK. Thumbnails are encrypted too. Folder names are encrypted under MK. Search by name runs on your device after decryption.
Share links
A link looks like /s/<linkId>#k=<key>. The file key is in the URL fragment, which browsers do not send to servers. The server stores the link id, the file it points to, the expiry, an optional password hash and a download counter. A link password is checked server-side with Argon2id; it gates delivery of the ciphertext, while the key still comes only from the link.
Developer builds and CI tokens
A CI job has no password and no MK. Each account has an X25519 keypair: the public key is stored in the clear, the private key is wrapped under MK. A CI upload generates a random FK, encrypts the file and its manifest, and seals FK to the account public key (sealed_fk). On your next unlock a device opens each sealed key with the private key and re-wraps it under MK.
Upload-only tokens are stored as SHA-256 hashes, can be revoked, show a last-used time and can expire. The server limits them to creating files and committing uploads under one app’s folder. They cannot list, download or delete. The CLI caches MK in the operating system keychain, never in a plain file.
What is not protected
- Metadata. The server sees file sizes, chunk counts, how many files you have, the folder tree (parent-child structure), timestamps, IP addresses and share-link activity.
- A compromised device or browser. Malware, a malicious extension or someone using your unlocked device can read what you can read. A keylogger can capture your password.
- The web app’s own code. The web app is delivered by our server. A server that is fully compromised could serve altered code. This is a limit of every web-based E2EE service. The native Android app does not have this exposure.
- Weak passwords. Argon2id slows guessing but cannot save a guessable password. Anyone holding the wrapped keys could try to guess offline.
- Lost keys. Forget your password and lose your recovery words, and your files cannot be recovered by anyone.
- Anyone with a full share link. The link is the key. Treat it like the file itself.
- Availability. Encryption does not prevent outages or the loss of data from a failure on our side. Keep another copy of what matters.
Review status
No independent security review of Flint Cloud has been published yet. We will say so here when one is.
Report a weakness
Write to hello@jijilabsdigital.com with details. Please do not test with other people’s data.