Security in this private alpha
Clear information about what is implemented and what still needs work.
Sign-in and unlock flow
1. Sign in with your invited email address and account password. 2. Complete authenticator-app MFA when required by the sign-in service. 3. Select one of your binders. 4. Enter that binder’s separate password to decrypt it in this browser. Account password reset does not reset a binder password.
Moving around the site
An unlocked binder stays available in this tab while you navigate within the site. The non-extractable key is held only in memory. Save & lock, sign-out, a page reload, closing the tab, or 30 minutes of inactivity clears it. Account sessions also have a maximum lifetime of eight hours. An adjustable inactivity setting is planned for later.
Multiple binders and future sharing
Each binder has its own encryption key and password. The server currently authorizes only the account that created it. Sharing a password alone does not authorize another account. Future collaboration needs both a binder-specific access grant and its decryption mechanism. A whole-binder password can decrypt all of that binder, so restricted section sharing will require a different key design. Legacy Contact permissions remain plans only.
How your binder is saved
The binder is encrypted in your browser with AES-256-GCM before it is saved. A key is derived from your binder password using PBKDF2-SHA-256 with a random salt and 600,000 iterations. The server stores encrypted binder content and cannot decrypt that stored content using the saved data alone.
Your account
An invitation-only account with multi-factor authentication identifies each tester. The server checks that identity for every binder request. Binder passwords and unlocked keys are not sent to the server or stored in browser storage. Account identity, account display name, binder labels and save timestamps are not hidden from the service.
Important limits
This is not a security-audited production service. Browser compromise or changes to the delivered application can compromise information while it is unlocked. We make no certification or compliance claims. Use sample information only.
Keep your password
Account password reset is available through sign-in. Binder password and key recovery are not available. A forgotten binder password means your saved binder cannot be unlocked. Keep the password somewhere safe.
Sharing and downloads
Contact permissions are plans only; recipients cannot access the binder in this alpha. PDF downloads contain readable information and are not password protected. Directly entered passwords and passcodes are omitted from PDFs. Uploaded files download separately; protect all downloaded copies.
Later phases
Binder key recovery, secure recipient sharing, release after death, and an escrow arrangement require further design and implementation.