Security Architecture & Vulnerability Disclosure

1. The Zero-Trust, Zero-Knowledge Threat Model

Standard cloud providers possess administrative authority to inspect, index, and process raw user files. Encbyt isolates users through client-side cryptography:

• No Server-Side Plaintext: Plaintext file data never touches our network interfaces, API memory buffers, or physical disks. Decryption executes purely inside your local browser memory.
• Zero Master Key Custody: Master keys and derived salts remain solely in local device memory during an active session. Encbyt infrastructure holds zero private keys, shadow administrator accounts, or backdoors.
• Cryptographic Opaque Payloads: Stored data blocks and folder records consist exclusively of authenticated ciphertext indistinguishable from random entropy. Outside observers cannot index or profile your vault.

2. Cryptographic Specifications & Implementations

All cryptographic primitives run natively in your web browser utilizing the standardized Web Crypto API:

A. Authenticated Data Encryption (AES-256-GCM)

Galois/Counter Mode ensures both confidentiality and cryptographic integrity. Any modification or corruption of ciphertext in transit or at rest triggers immediate cryptographic rejection before decryption.

B. Local Key Derivation & Hardening (PBKDF2)

This computational hardening protects user vaults against offline dictionary attacks, automated rainbow-table matching, and GPU brute-force attempts.

C. Transport Layer Security (TLS 1.3)

All network communications between the browser and distributed storage clusters travel across TLS 1.3 channels enforced with Perfect Forward Secrecy (PFS), eliminating transit eavesdropping.

3. Sovereign 24-Word Recovery Protocol

Because Encbyt maintains no centralized backdoors to reset forgotten credentials, account recovery is governed through self-sovereign cryptography:

• Deterministic 24-Word Seed: Generated entirely on your device during account setup, this phrase encodes entropy sufficient to re-derive your master keys independently.
• Password Resets via Seed: Entering your 24-word recovery phrase inside the recovery console allows your browser to rebuild your encryption keys and assign a new master password without administrative intervention.
• In-Session Regeneration: If you know your active master password, you can view or regenerate a fresh 24-word recovery phrase at any time inside Account Settings → Cryptographic Security, immediately invalidating previous seeds.
• Irreversible Loss Disclaimer: If you lose both your master password and your 24-word phrase, your vault remains mathematically locked forever. We cannot override your credentials or decrypt your data.

4. Device Memory Stability & Resilient Transfers

• Browser-Optimized 5 GB Single-File Limit: To protect your device from memory exhaustion during heavy in-memory Web Crypto calculations, the web console enforces a maximum 5 GB per-file ceiling. Users can store as many 5 GB files as their vault tier accommodates. Standalone desktop sync clients for larger files are in active development.
• Fault-Tolerant Pause & Resume: Encbyt tracks segment transfer states locally in browser memory. If a network connection drops or a user manually pauses, transfer states remain intact, enabling byte-accurate resumption without data re-encryption or corruption.
• 90-Day Standby Dormant Preservation: Unrenewed evaluation or subscription accounts transition to an isolated dormant tier for ninety (90) days, preserving ciphertext blocks without risk of accidental data loss.

5. Responsible Vulnerability Disclosure Program

We welcome collaboration with cybersecurity researchers, penetration testers, and academic cryptographers who identify potential vulnerabilities in our client-side implementations or infrastructure layers.

Our Disclosure Commitments:

• Initial Response SLA: Our security engineering desk reviews and acknowledges valid technical reports within 48 business hours.
• Remediation Timeline: We prioritize critical vulnerabilities, deploy fixes promptly, and maintain open communication regarding release schedules.
• Coordinated Public Disclosure: We coordinate public disclosure with researchers after a patch has been verified and deployed across all storage clusters.

6. Research Scope & Safe Harbor Covenant

A. Scope of Testing

• Client-side Web Crypto key derivation, segmenting, and hashing logic.
• Zero-knowledge public link sharing hash fragment handling (`#`).
• Authentication, session rotation, and CSRF token governance.
• API rate-limiting and access boundary validation.

B. Out-of-Scope & Prohibited Actions

• Denial of Service (DoS/DDoS) attacks against routing fabrics or API endpoints.
• Accessing, modifying, or compromising vaults belonging to other users.
• Social engineering, phishing, or physical attacks against Encbyt team members.
• Exhausting storage infrastructure through automated script flooding.

7. Security Desk & PGP Communications

All cryptographic vulnerability disclosures, technical audits, and security inquiries should be submitted directly to our security operations team: