Security & encryption

Consortium is built so that the server syncs ciphertext, not your code. This page states precisely what that means — including the limits.

What is end-to-end encrypted

For your own (single-user) data, only your devices hold the keys. The server stores and relays ciphertext for:

• Session messages, session metadata, and agent state
• Machine metadata and daemon state
• Artifacts (headers and bodies) and attachments
• Key-value store values
• Drive file contents and file names (per-node encrypted metadata)

Encryption uses libsodium/TweetNaCl primitives: XSalsa20-Poly1305 (legacy envelope) and AES-256-GCM with a per-session data-encryption key (DEK), wrapped per recipient. Sessions support DEK rotation: rotating a key bumps its version so previously distributed ciphertext can no longer be decrypted by revoked parties.

What the server can see

Being honest about the boundary matters more than a long feature list:

• Structural plaintext: IDs, sequence numbers, timestamps, session tags, and versions (needed for sync and ordering).
• Names of containers: organization, Drive, and workspace names are plaintext today (contents are encrypted).
• Shared/team data is encrypted and access-controlled by Consortium. Sharing inside organizations is enforced by server-side permissions (roles, members, wrapped keys distributed by the server) — not yet by cryptography alone. Treat team sharing as “the server is trusted to route keys correctly,” which is a different guarantee than single-user E2EE.
• Third-party service tokens you connect for server-side use (e.g. GitHub) are encrypted at rest but are usable by the server on your behalf — that’s their purpose.

Identity & keys

• Your identity is a 32-byte master seed, exportable as a 24-word recovery phrase. Keep it safe; it is the root of your encryption.
• There are no passwords. Devices authenticate by public-key challenge/response and hold per-device, revocable tokens (90-day lifetime).
• On web and desktop, the seed at rest can be protected with a passkey (WebAuthn PRF) unlock.
• Provider keys for BYOK stay in your devices’ secure storage unless you explicitly opt a credential into server escrow.

Honest limits

No forward secrecy yet

A stolen master seed decrypts your past and future single-user data until you rotate keys. Protect the recovery phrase accordingly.

• The web app’s trust model is weaker than native. The browser runs code served by the same operator that stores your ciphertext; a malicious server could serve altered code. Native/desktop builds don’t have this property. Use the desktop or mobile apps when this matters to you.

Managed inference is visible to the model provider

Encryption protects storage and sync, not the LLM call itself. Anything you route through managed inference is seen in plaintext by the provider you selected.

Operational security

• 2FA (TOTP) is available at sign-in; admin surfaces require it.
• OAuth refresh tokens rotate on every use, and reuse revokes the grant.
• Emergency version blocking lets known-bad client builds be forced to update.

For the precise wire formats and field-by-field encryption tables, the engineering source of truth is docs/encryption.md in the repository.