Encryption, engineering and the occasional opinion.
Notes from building an end-to-end encrypted document platform in Europe.
-
NIS2 and DORA: the audit log they expect
Neither law hands you a log format. Both say what a log must be able to do once an incident is on the clock. What NIS2 and DORA ask of an audit trail, and how Sapherbox's answers.
-
Passkeys, MFA and single sign-on in an end-to-end encrypted product
Signing in has two jobs in Sapherbox: proving who you are, and opening your keys on your device. How passwords, a second factor, passkeys and Entra ID each handle both.
-
Why adding someone takes two steps
Inviting a person who has no account yet is an invitation first and a key handover later. The gap between the two is not bureaucracy: the key they need does not exist until they register.
-
Large files, encrypted in the browser: how a 20 GB upload works without trusting the server
Chunked encryption with constant memory, S3 multipart behind the backend, per-chunk integrity, and a download path that streams straight to disk. The engineering behind big files in Sapherbox.
-
Post-quantum security: who has already written the requirements, and what they ask of you
NIST, the EU, BSI, ANSSI, the UK NCSC and the NSA have all published post-quantum timelines. What they agree on, where the dates fall, and how to read them for an encrypted document platform.
-
Workflows on encrypted data: what automation can do when the server is blind
Alerts, retention, webhooks and scheduled computation on files the server cannot read. What a workflow sees, what runs where, and the two actions that need your device.
-
An audit trail that cannot be quietly edited
An audit log is only evidence if nobody can rewrite it. Sapherbox links every entry to the one before with an HMAC chain, and one button recomputes it all. Here is the design, and its limits.
-
Deletion and recovery: what comes back, and what is gone for good
Deleting a file in an encrypted system has two sides: the person who wants it back and the organisation that needs it gone. How the recycle bin, versions, scheduled deletion and backups fit together.
-
Desktop sync that stays encrypted
Encryption that only works in a browser gets bypassed the moment someone needs a file in Explorer or Finder. The Sapherbox sync client brings the same keys and the same rules to a normal folder.
-
How sharing hands over a key on your device
Sharing a folder in an end-to-end encrypted system means handing someone a key without the server ever holding it. Here is how Sapherbox seals, signs and pins that handover.
-
Who may do what: roles and permission levels
Sapherbox answers the permissions question three times over: what you may do with a folder, for a group, and to the tenant. Here is each layer, and why they are kept apart.
-
Service accounts with narrow scopes
Integrations should not log in as a person. Sapherbox gives them their own account, their own keys and an API key that can do exactly what you listed. Here is how that fits end-to-end encryption.
-
Why we encrypt file and folder names, not just contents
A file name is often the most sensitive thing about a file. Most encrypted drives leave names in the clear. Sapherbox does not, and the folder-key design is what makes that cheap enough to do.
-
Safe uploads without a server that reads them: content disarm and reconstruction
An end-to-end encrypted platform cannot scan files on the server. Sapherbox removes active content before encryption instead. What that covers, and where antivirus still belongs.
-
Links for people without an account
Sometimes the other side has no account and never will. Sapherbox's download and upload links keep end-to-end encryption intact anyway: the key travels in the URL, and the server never sees it.
-
Share with the group, not the person
Granting folder access one person at a time looks precise and ends up neither productive nor secure. Groups make membership a single fact to keep current, and the cryptography follows.
-
The right to erasure, without a ticket
GDPR gives everyone the right to have their data deleted. For guests on a Sapherbox tenant that right is a button on their own profile, not a ticket at someone else's helpdesk.
-
What our servers can and cannot see
End-to-end encryption hides content, not everything. Here is the complete list of what a Sapherbox server holds in plaintext, why each item is there, and what it cannot read.
-
Whoever shares is responsible
In Sapherbox the person who shares a folder answers for who can open it, inside or outside the organisation. That only works if they can see their own sharing. Here is what they see.
-
"Zero knowledge" is a design, not a policy
Many providers promise not to look at your data. Far fewer are built so that they cannot. The difference is structural, and it shows up in the details a vendor page leaves out.
-
Automatic classification, and why GDPR compliance depends on it
You cannot protect, report on or delete personal data you cannot find. How Sapherbox classifies documents on your device before encryption, and what that gives you under the GDPR.
-
Hybrid post-quantum key wrapping, explained for non-cryptographers
Every key that protects a Sapherbox file is locked twice, with a classical algorithm and a post-quantum one. Here is what that means, why both, and what it does not cover.
-
AI that never sees your documents: summaries and translations on your own device
Sapherbox can now summarise notes, translate previews and produce translated copies of Office documents. The model runs inside your browser, so nothing leaves your device.
-
Password reset without a provider backdoor
If nobody but you holds your keys, nobody can reset them for you. Here is how Sapherbox handles forgotten passwords and departed employees without keeping a key of its own.
-
Revocation means changing the locks
Removing someone from a shared folder is easy to show in a user interface and hard to make true. Here is what Sapherbox does when access is taken away, and what no system can take back.
-
Searching encrypted documents: blind indexing
Full-text search over files the server cannot read sounds like a contradiction. Here is how Sapherbox does it, what the server learns from it, and where it stops.