Public commitment · Updated December 2026

Security Roadmap

Concrete commitments rather than marketing. Dates are best estimates and can slip; if they do, we update this page. We list only items we intend to actually deliver.

• shipped
  Client-side encryption (Argon2id + X25519 + XChaCha20-Poly1305)

  All file content and most metadata encrypted on the user's device before upload.

  Target: Q1 2026
• shipped
  Zero-knowledge public sharing

  Ephemeral X25519 share key, decryption key lives only in URL fragment.

  Target: Q1 2026
• shipped
  Passkeys (WebAuthn) and TOTP MFA

  Hardware-backed second factor and standard TOTP for accounts that prefer it.

  Target: Q1 2026
• shipped
  Append-only audit log with database-level immutability

  All security events recorded; UPDATE/DELETE blocked by trigger.

  Target: Q1 2026
• shipped
  Recovery key + secondary channels (email / SMS)

  Three-way master-key wrapping. We recommend enabling at least two factors.

  Target: Q1 2026
• shipped
  30-day trash + 30-day account deletion grace period

  Hard delete only after cooling-off and after audit trail confirmation.

  Target: Q1 2026
• shipped
  Streaming encryption for large files

  Large files are encrypted and decrypted in chunks with progressive reading instead of being buffered whole in memory.

  Target: Q1 2026
• shipped
  Resumable, chunked uploads

  Large uploads on unreliable connections resume from where they left off instead of restarting.

  Target: Q1 2026
• shipped
  Geographic anomaly detection on new sessions

  New session from a previously unseen country logs a warning-severity event.

  Target: Q2 2026
• shipped
  Ciphertext SHA-256 integrity hash

  Verify-before-decrypt at download time; integrity alerts on mismatch.

  Target: Q2 2026
• shipped
  Ed25519 manifest signatures

  Public share and protected message manifests signed and verified client-side.

  Target: Q2 2026
• shipped
  Strict Content Security Policy with violation reporting

  script-src 'self', no inline scripts in the runtime, dedicated /api/public/csp-report sink.

  Target: Q2 2026
• shipped
  Password-protected public links with a 24-hour maximum lifetime

  Optional password proof verified server-side without the server learning the password; every public link now expires within 24 hours at the latest.

  Target: Q2 2026
• shipped
  Hardened account-recovery flow

  Server-side verification of recovery proofs before releasing any wrapped key material, with tightened rate limiting.

  Target: Q2 2026
• shipped
  RLS immutability triggers and identity-anchored policies across collaboration tables

  Row-level security on teams, rooms, and shared-folder data anchored strictly to authenticated identity, with triggers blocking tampering of protected records.

  Target: Q3 2026
• shipped
  Per-channel role enforcement in Rooms

  Viewer / creator / moderator / admin / owner permissions enforced at the database layer.

  Target: Q3 2026
• shipped
  Scoped API keys and HMAC-signed webhooks

  API keys limited to specific scopes and stored hashed; outgoing webhooks signed with HMAC-SHA256.

  Target: Q3 2026
• shipped
  Automated security test suite (226 tests) with CI privacy gate

  RLS isolation checks, fuzzing of server functions and triggers, and a CI gate that fails the build on any plaintext-egress code path.

  Target: Q3 2026
• in progress
  External cryptography review

  Coordinated engagement with an independent reviewer focused on key wrapping and recovery.

  Target: Q1 2027
• in progress
  Step-up authentication for sensitive actions

  Disable 2FA, GDPR export, account deletion, and recovery management gated by fresh proof of possession.

  Target: Q1 2027
• in progress
  Recovery health check + emergency kit PDF

  Periodic prompt when fewer than two recovery factors are configured, plus a printable recovery package.

  Target: Q1 2027
• in progress
  SOC 2 readiness assessment

  Internal control mapping and gap remediation ahead of a future formal audit. Not a certification.

  Target: Q1 2027
• in progress
  ISO 27001 gap analysis

  Reviewing our information security management practices against the standard's requirements. Not a certification.

  Target: Q1 2027
• in progress
  CSP nonces for remaining inline styles

  Removing residual 'unsafe-inline' allowances by moving to per-request nonces.

  Target: Q1 2027
• planned
  Hardware key attestation for device trust

  Bind devices to FIDO2 attestation, surface device trust level in the dashboard.

  Target: Q2 2027
• planned
  Third-party penetration test

  Independent firm; scope covers backend RPCs, RLS, and crypto integration.

  Target: Q2 2027
• planned
  Subresource integrity for static assets

  SRI hashes on third-party and CDN-served scripts to detect tampering in transit.

  Target: Q2 2027
• planned
  Reproducible builds with public attestations

  Publish build hashes signed by our release process.

  Target: Q2 2027
• planned
  Official Zapier directory app

  Move from REST-hook compatibility to a listed, reviewed app in the Zapier directory.

  Target: Q3 2027
• planned
  Configurable audit-log retention windows

  User-facing setting to expire non-security audit events on a chosen schedule.

  Target: Q3 2027