Only your computers can open it.
Encrypted on your computer before it leaves, path included. We hold bytes nobody can open, us included. For your security review: the Blind Vault, every guarantee with its limit.
Open or sealed. You pick per space.
Open reaches your phone and every AI. Sealed opens only on your computers.
- runbooks/deploy.mdthe steps
- style/writing.mdhouse style
- decisions/2026.mdthe log
- people/onboarding.mdday one
- finance/margins.mdby client
- pay/bands.mdevery band
- postmortems/march.mdwith names
- me/passport.mdyour Sealed space
Every key holder is signed.
A manager's computer signs each admission. Every computer checks the chain before it takes a key, wrapped for it alone in X25519 with ML-KEM-768, so a quantum computer cannot later open what it captured. Seventeen ways a lying server fails, each a test run before a release.
- entry 0 · founded
The founder's MacBook
Makes the first key. Signs the first entry.
epoch 0 · key 3f9a - entry 1 · admit
The office Mac
Signed by the MacBook. The key turns.
epoch 1 · key a41c - entry 2 · admit
A new hire's laptop
A person compared the fingerprint and approved. Live pages only, nothing older.
epoch 2 · key c08d - entry 3 · remove
The office Mac
A new key its disk never gets.
epoch 3 · key e2b1
A teammate's first laptop gets the key once you approve its fingerprint.
The new computer shows a fingerprint. A manager's computer asks about the same one. Their next computer is approved the same way, on a computer of theirs already in, and the space takes it with no question.
Does it match the fingerprint on that computer?
- Epoch 2. A new key, wrapped to the new laptop.
- 212 pages sent up again under it.
- Live pages only, nothing older.
- We learn a fingerprint, never a key.
A lost laptop comes back from one file.
One file and one passphrase bring back every sealed space it read. The new computer makes new keys, takes over the spaces the lost one managed, and turns each space's key; you revoke the lost laptop on Devices.
Revoke it in the cockpit. Its key leaves every chain.
one click on Devicesinstibrain key backup, under a passphrase. Argon2id, 64 MiB, three passes.
Restores the backup, signs itself in, turns the keys, pulls every page.
every sealed space the lost one readDevices names each computer that has no backup.
It marks every computer that holds a sealed key without one, and the sync client warns when a backup misses a newer key.
Lose every computer and the backup, and nobody opens it again. Us included.
Our server still sees the space's name, each page's size step, and when it changed.
Every edge, published. Details on the security page.
| What our server still sees | What that means |
|---|---|
| The space's name, and which pages are in it | visible |
| Each page's id, size step, version, and push time | visible |
| Which public keys were admitted, and when | visible |
| A title, a path, a folder, or one word | never |
| A version history | never kept |
| The edge | Verdict |
|---|---|
| A first sync trusts the chain until its person pins the founder's fingerprint | compare first |
| A page seen for the first time may be an older version | open |
| Any process running as you can read the key file | open |
| Someone removed keeps what they already pulled | forward only |
| Your unlocked computer and the model you ask see plaintext | by design |
| A quantum adversary decrypts captured wraps later | blocked |
Keep pay, health, and legal in the same brain, sealed.
Hand this page to whoever runs your security review.