Public commitment · Updated May 2026

Security Roadmap

Concrete commitments rather than marketing. Dates are best estimates and can slip; if they do, we update this page. We list only items we intend to actually deliver.

• shipped
  Client-side encryption (Argon2id + X25519 + XChaCha20-Poly1305)

  All file content and most metadata encrypted on the user's device before upload.

  Target: Q1 2026
• shipped
  Zero-knowledge public sharing

  Ephemeral X25519 share key, decryption key lives only in URL fragment.

  Target: Q1 2026
• shipped
  Passkeys (WebAuthn) and TOTP MFA

  Hardware-backed second factor and standard TOTP for accounts that prefer it.

  Target: Q1 2026
• shipped
  Append-only audit log with database-level immutability

  All security events recorded; UPDATE/DELETE blocked by trigger.

  Target: Q1 2026
• shipped
  Recovery key + secondary channels (email / SMS)

  Three-way master-key wrapping. We recommend enabling at least two factors.

  Target: Q1 2026
• shipped
  30-day trash + 30-day account deletion grace period

  Hard delete only after cooling-off and after audit trail confirmation.

  Target: Q1 2026
• shipped
  Geographic anomaly detection on new sessions

  New session from a previously unseen country logs a warning-severity event.

  Target: Q2 2026
• shipped
  Ciphertext SHA-256 integrity hash

  Verify-before-decrypt at download time; integrity alerts on mismatch.

  Target: Q2 2026
• shipped
  Ed25519 manifest signatures

  Public share and protected message manifests signed and verified client-side.

  Target: Q2 2026
• shipped
  Strict Content Security Policy with violation reporting

  script-src 'self', no inline scripts in the runtime, dedicated /api/public/csp-report sink.

  Target: Q2 2026
• in progress
  External cryptography review

  Coordinated engagement with an independent reviewer focused on key wrapping and recovery.

  Target: Q3 2026
• in progress
  Step-up authentication for sensitive actions

  Disable 2FA, GDPR export, account deletion, and recovery management gated by fresh proof of possession.

  Target: Q3 2026
• in progress
  Recovery health check + emergency kit PDF

  Periodic prompt when fewer than two recovery factors are configured, plus a printable recovery package.

  Target: Q3 2026
• planned
  Hardware key attestation for device trust

  Bind devices to FIDO2 attestation, surface device trust level in the dashboard.

  Target: Q4 2026
• planned
  Full external penetration test

  Independent firm; scope covers backend RPCs, RLS, and crypto integration.

  Target: Q4 2026
• planned
  Reproducible builds with public attestations

  Publish build hashes signed by our release process.

  Target: Q4 2026
• planned
  Configurable audit-log retention windows

  User-facing setting to expire non-security audit events on a chosen schedule.

  Target: Q1 2027