Vault & Trust
Your secrets, encrypted on your devices, provable without us.
Credentials and secrets stay as ciphertext that only your enrolled, vault-admitted devices can open. Every device gets its own sealed envelope, so removing a laptop actually removes it — the vault key rotates rather than a server merely declining to serve. The design is deliberately checkable rather than promised: your client enumerates the recipient set and the certificate chain locally.
- 4Working today
- 4Being built
- 10Planned
The mechanism, not the metaphor.
- 01 Enroll a device
A device-generated key is redeemed against an enrollment token for a root-chained certificate.
- 02 Admit it
A separate signed admission record binds that certificate. Enrollment alone grants nothing.
- 03 Seal per device
The epoch key is wrapped into one envelope per admitted device and per recovery principal.
- 04 Write a revision
A fresh record key encrypts the payload and is itself wrapped under the current epoch.
- 05 Use, don't export
Operate performs the signature or the connection inside the daemon. Only Reveal releases bytes.
- 06 Revoke and rotate
A membership change bumps the epoch and rewraps to whoever remains.
18 capabilities, and where each one stands.
How a vault is keyed
- Planned Per-device envelopes
Each device gets its own wrapped key. No shared per-person key exists anywhere.
- Planned Vault epoch key
One key per epoch, rewrapped to exactly the devices allowed right now.
- Planned Fresh key per revision
Every write gets its own key, so damage stays compartmentalised.
- Planned Rotation on membership change
A removed device cannot read anything written after it left.
- Being built Frozen record layouts
Byte-exact formats, so a reader in another language cannot silently drift.
Who a device is
- Being built Device certificates
Your devices prove they are yours from a signed certificate.
- Being built Signed device list, verified offline
Two devices on one desk trust each other with no server reachable.
- Planned Admission is its own record
Joining your account does not grant vault access. Admission is signed separately.
- Working today Revocation that ends live access
A revoked device stops asking and stops answering, immediately.
- Working today Identity across key rotation
Rotate a device key without re-enrolling or renaming the device.
Using a secret without handing it over
- Planned Operate, Materialize, Reveal
Secrets get used without being exported. Export is the exception, not the default.
- Planned Custody choice per vault
You pick whether anyone but you can ever recover a given vault.
- Planned Recovery from twelve words
Lose every device; a paper phrase opens a new device generation.
- Planned Team and shared vaults
Out of scope for the first release, which is one person and several devices.
The wire itself
- Working today QUIC, encrypted end to end
Peer-to-peer bytes between your own devices, over TLS 1.3.
- Working today A relay is a path, not an endpoint
Works through NATs, and the relay forwards ciphertext it cannot read.
- Being built Key protection at rest
Device identity survives a reboot without prompting at cold start.
- Planned Mobile at-rest encryption
Local history on phones encrypted under a platform-wrapped root key.
Numbers from tests that ran.
- Named, frozen
SHA-256, Ed25519 verify_strict, XChaCha20-Poly1305 and HPKE base X25519-HKDF-SHA256, over seven length-exact record layouts.
- No envelope exists
A device that was never admitted has nothing addressed to it — which holds even if that machine is fully compromised.
- Cannot mint, cannot read
A fully compromised coordination server can withhold, delay and serve stale state. It cannot mint a device or read a vault.
- Exactly your devices
Custody mode is the recipient set itself, signed and validated on every rotation — so your client can enumerate it and say so.
And what it is not
- Not key escrow, and not "just log in and it works". There is no server-side custody of your keys.
- Not a per-person key layer. Envelopes are per device, so removing one laptop is not a person-wide reset.
- Not removal without rotation. We do not call it cryptographic removal when it is only a server declining to serve.
- Not "an administrator can never read". Where recovery exists, decryption exists — and a service-custodied mode is never called zero-knowledge.
Start with the devices you already own.
Make them work
as one.
The open core is ready to explore. Build your personal device fabric with Xross.
Open-source core · Direct by design · Your devices, your fabric