Every action inside our control surface becomes a cryptographically signed event, hash-chained, hourly-Merkle-sealed, and Bitcoin-anchored. Sovereign-tier customers hold their own signing key: we physically cannot forge on their behalf.
Every action (wrap / open / burn / message / file upload / copy-block / device-approval / 50+ types) creates one row in nd_operator_receipts with its own event_hash, Ed25519 signature, prev_receipt_id and chain_index. The hourly Merkle seal does NOT merge events, only their hashes.
Each receipt commits to its predecessor via prev_receipt_id + chain_index. Modifying a single row breaks every receipt that follows. Same pattern as Certificate Transparency, applied to data-action events.
Each hour, all event_hashes in the window roll into a sorted Merkle tree (order leakage neutralized), the root is Ed25519-signed and submitted to OpenTimestamps which anchors it to a Bitcoin block. Once confirmed, rewriting history requires a Bitcoin reorg.
On Sovereign tier the customer generates an Ed25519 keypair inside their local SQLCipher vault (Argon2id-derived). Every heartbeat / metrics / entry-exit Border Control proof is signed with that key. Server verifies on every receive. NoData physically cannot forge, we do not hold the key.
When you burn, we don't soft-flag the row. We destroy the content_key. A full DB backup cannot reconstruct the file. Where competitors offer 'retention deletion', we offer mathematical unrecoverability.
The line we stand behind: "every interaction within the controlled surface". The table below is the exact definition of "the controlled surface". No overclaim.
CISOs ask "what's actually live?". This table doesn't blur vapor and vision, it separates LIVE (running in production today), TIER-GATED (exists but only on specific tiers), and ROADMAP (not built yet · we say so out loud).
Provability is a 4-step ladder. We prove the first two for anyone · step 3 needs the customer's vault · step 4 needs a human. The content itself stays with the customer · we prove existence + integrity + timing, not content.
Each layer is autonomous · each verifies the one before it. Content never crosses the boundary of layer 01. Only signed hashes go outward. The Bitcoin anchor isn't bolted on, it's wired in from day one.
Tauri 2.0 (Rust) binary · SQLCipher vault (Argon2id-derived key) · Customer Ed25519 keypair generated inside the vault · Scanner detects PII/secrets · Border Control witness chain stores every entry/exit with prev_hash linkage.
/api/sovereign/heartbeat receives {license_key, machine_fp_hash, customer_pubkey, signature} and verifies. /api/sovereign/metrics receives aggregated counts + proof_hash, never content. Each receipt creates an nd_operator_receipts row Ed25519-signed with prev_receipt_id linkage.
Worker runs hourly, collects every event_hash in the window, sorts lexicographically (kills order leakage), computes Merkle root, signs with Ed25519. seal-of-seal via prev_epoch_id creates a chain-of-chains.
OpenTimestamps submits the Merkle root to a Bitcoin block header. After N confirmations, rewriting history requires a Bitcoin reorg. Sigstore is available as an alternative for CISOs refusing public blockchain. Seals are published to a public GitHub witness feed so third parties can archive.
Every claim above is verifiable without our involvement. These are the public entry points:
Our public threat model - what we protect, what we don't, and the risks we acknowledge
Exactly what's encrypted, what's not, which algorithms, and where the limits are - nothing hidden
Found a vulnerability? Here's our policy, channels, and response times
Software Bill of Materials - every dependency, version, and license our system uses
Send sealed files with full policy (TTL · max opens · device-bind · CC/BCC · sealed Gmail label / Outlook category) via your own Outlook or Gmail · NoData sees no content · every open = device chip + signed receipt.
Live Drive + Gmail inventories · NoData never reads mail body · 🔒 reply sealed keeps Gmail threads continuous · Docs/Sheets/Slides auto-converted to PDF/xlsx on seal · per-user OAuth · each user sends as themselves, not as NoData.
Every active share in one place · filter by status/recipient/TTL · colored device chips for openers · drill-in to Per-Share Dashboard with forensic timeline · REVOKE / BURN in one click · crypto-shred of the wrapping key · proof of destruction signed as Signet receipt.
Outlook + Gmail per-user OAuth · recipients see your real from address · full CC/BCC support · 'NoData-sealed' checkbox adds Gmail label / Outlook category for discovery filtering · every action → signet receipt with exact sender identity · admin fallback if user hasn't connected.
Daily Digest (24h/7d/30d period) · Audit CSV export (200 receipts) · Findings CSV export (severity + remediation) · public shareable Trust Page URL · Dashboards Hub (8 cards + 4 quick stats) · CISO opens in morning · understands org state in 90 seconds · each card → drill-in.
Users v2 (4-stat + custody-model · pending_admin_approval) · Seats v2 (6-stat + dual-model billing) · Invitations v2 (anonymity-model · ext_email_hash · multi-use) · Dual-control Approvals (4 tiers · active locks + history) · File retention (3 options with price tag). Every action emits a signet receipt · no content exposed.
Backups (12-words iron-rule · proof hash · no content) · Keys (key release count · rotation history · 4 CISO Q&A) · Master Key read-only (dual-control rotation only) · Devices attestation (pending_admin_approval flow live · fingerprint + IP + UA · precursor to Painted Devices). Every action signed receipt.
Assignments (asset_assignments + capability JWT scope) · Assets (data_assets + risk_groups · blast radius mapping) · Capsule hub (deployments + open findings) · Capsule targets (6 kinds · scope clear) · Capsule apps (6-axis catalog: detect/protect/enforce/alert/audit/recover). CISO maps the blast radius of leakage before it happens.
Processes v2 (active/flagged/completed · chain receipt) · Process templates (GDPR · HIPAA · SOC2 · ISO27001 · onboarding) · Scan v2 (severity + RLS coverage) · scan-local (in-browser · zero-upload · 8 phases) · Sovereign Capsule (Tauri desktop · Customer Ed25519 + Border Control · proof-only telemetry · NEVER schema names or file paths).
ProcessBoard live workflows · Signet policies (audit-grade enforce + TTL + attestation) · Signet workflows (multi-step approval · receipt per step) · Incident Response (WOW #2: alert → /incident/[receiptId] → evidence pack PDF + 1-click burn + 4 fix-script options · 30 seconds from alert to mitigation with signed proof).
Every AI agent (Claude · GPT · internal) gets a dedicated bearer + scope DSL (allowed columns + team filter + classification) · DAL derives an HKDF per-column key ONLY for columns in scope · denied columns return bytea that physically cannot be decrypted · out-of-scope reads = 403 + signed receipt on SHA-256 + HMAC chain · /verify-pack/agent-read/[id] gives a public verification page with selective reveal (PII column names → [redacted-pii-column] · row counts → bucket).
Two-phase HMAC-signed challenge · phase 1 returns a token with iat + min_wait_ms signed in · phase 2 rejects if now < iat+min_wait. Humans see an 8-second countdown · bots that race ahead hit 429 too_fast. No way to forge the token (server-side HMAC) · no way to skip the wall-clock (signed into the token). Stateless primitive · serverless-safe · /demo/pause-unlock for interactive walkthrough.
Every employee gets their own /me/showcase landing showing the capabilities the admin allocated · allowed envelopes + TTL ceiling + max opens + device-binding + daily quotas. Itai (tenant_admin) allocates and revokes via /tenant-v2/[id]/users/[uid] · 100% UI · zero curl. Every allocation/revoke signed in the signet chain via applySignetAsync (persistent chain). Default-deny · an employee without allocation cannot act.
What we publish ourselves - can't be exposed against us. We publish our threat model, our own scan results, and our algorithms.
AES-256-GCM, RSA-OAEP, PBKDF2, scrypt - open, recognized standards. No "proprietary magic". Security through obscurity is not security.
We're not perfect, and we say it out loud. Our threat model includes what we don't protect. 38 controls - not 1,000. SOC-ready - not SOC-certified.
Capsule runs on Capsule itself - 24/7. If our scanner finds an issue on us, we fix it and publish.
Crypto-shred is immediate in the live DB. The following residuals exist and are fair to know about:
If you chose proof+backup retention, your Supabase project may retain wrapped keys in point-in-time backups for the retention window you configured (default 7 days). Crypto-shred is immediate in the live DB · the backup window remains until rotated. Default retention = receipt-only (no content backup).
After a recipient opens a sealed file, the unwrapped content_key may be cached in browser memory until the tab closes or cache clears. Burn removes the ability to fetch the key from the server · but the file on the recipient's machine remains accessible until the browser releases that memory.
Found something? Report here. We respond within 24 hours.