Security

Zero-knowledge

People's computers encrypt everything before it is sent. The server, its disks and its backups hold only sealed data — collection names included.

• Each collection has its own key, sealed to each member's personal key
• Being an administrator does not let you read a collection you have not been given
• Manic Control, if you link it, never sees keys, items, collection names or master passwords

Fingerprints

People only become active after an administrator checks their key fingerprint with them.

• The new person's app shows their key fingerprint
• An administrator phones or meets them, has them read it out, and types what they read; the server accepts it only if it matches
• This stops someone who intercepts an invite from joining as that person, so it should never be done over the same email or chat the invite went through
• Someone who joins again from another computer gets a new key and is confirmed again

Recovery code

An organisation recovery code, kept offline by the owners, can restore access to a collection when nobody who manages it is left.

• It is shown once, when the organisation is set up
• Neither the app nor the server keeps it, so save or print it and keep it offline, in a safe or with a second owner
• The app refuses to share anything new if the recovery key the server reports ever changes

Audit log

Every sign-in, share, change and use is recorded.

• Each entry is chained to the one before, so edits are detected
• Administrators read it under Team administration, and the server can check the chain with one command

Certificate pinning

Apps pin the server's certificate from the invite link.

• The connection cannot be intercepted, not even by a TLS-inspection proxy
• If the certificate does not match, the app refuses to connect
• Keep the server's certificate, and do not put a reverse proxy or load balancer that ends TLS in front of it

Owners and backups

• Owners always stay local: Manic Control can never make or unmake an Owner, so owners are the break-glass accounts
• Backups hold only sealed data, but with the TLS key they can stand up a copy of your server, so treat them as sensitive
• If Manic Control cannot be reached, members sign in with their device key as usual and the audit log notes it