How your key works, and what we can see
A security product should never overclaim. This page explains the design in plain words, lists what our servers can read for each part of Atrium, and says where the protection stops.
The key, in plain words
- Your master password stays on your device. Your browser turns it into a key using Argon2id, a deliberately slow function that makes guessing expensive. We receive only a value derived from it that lets us confirm you typed it correctly. That value can't decrypt anything.
- That key unlocks your account key. Your account key is random and is stored on our servers only in encrypted ("wrapped") form. It is unwrapped in your browser's memory when you unlock.
- The account key unlocks everything else. Each vault, notes workspace and calendar has its own key, and each vault item and note has its own key beneath that. Content is encrypted with AES-256-GCM.
- Keys live in memory only. They are never written to your disk or browser storage, and they are dropped when the vault locks: after 15 minutes idle, or when you close the tab.
Sharing uses public-key encryption: to share, your device seals the item's key to the other person's public key, and only their device can open it. Our servers pass the sealed box along without being able to open it.
What our servers can and cannot see
| Part | We can see | We cannot see |
|---|---|---|
| Account | Your email address, sign-in times, devices and sessions, plan and billing records | Your master password, your keys |
| Vault | How many items you have and their rough type, sizes, timestamps, folder and sharing structure, schedules, audit events | Item names, usernames, passwords, authenticator keys, notes, file names and file contents |
| Notes | How your folders nest, sizes, when notes change, version count, whether a note is shared | Note titles, file names, text, tags, links and attachments |
| Calendar | Event start and end times, repeat rules, reminder times, calendar colours. Calendars you subscribe to by link (including holiday calendars) come from outside, so our server fetches them and can read them; they are stored encrypted with our key, not yours | Titles and details of events in your own calendars, including events you import from ICS files |
Event times are readable to us on purpose: without them we could not send reminders or work out repeating events. Reminder emails contain the time only, never the title.
Schedules on time-locked items are readable too, because our server enforces them with its own clock. It holds an extra lock layer on a scheduled item and removes it only inside the window. That layer controls when an item can open; it can't decrypt the item.
Importing and exporting the vault happen the same way: a file you import is parsed in your browser and every item is encrypted before it's uploaded, and an export is decrypted in your browser and written straight to your disk. Either way the plaintext never reaches us. More detail: Importing and exporting your vault.
What this protects against
- A stolen copy of our database or backups: it contains ciphertext and wrapped keys.
- Our own staff and administrators: our admin tools have no way to decrypt your data.
- Someone reading traffic between you and us: only ciphertext crosses the wire, inside TLS.
Where the protection stops
- Tampered code from our server. Like any encrypted web app, the Atrium web app runs code our server sends to your browser. If that code were tampered with, it could capture your master password as you type it. We reduce this risk with a strict Content Security Policy and by never receiving your password or keys, but we do not claim it is solved. The browser extension (coming soon) will help: its code is installed on your computer rather than downloaded from us on each visit.
- A compromised device. Malware, a keylogger or a malicious browser extension on your device can see what you see and type. No password manager can defend against that.
- A weak master password. Argon2id makes guessing slow, and the setup screen shows password strength, but a guessable password is still guessable.
- Things you've already seen. Once a time-locked item opens, or a shared item is read, the information can be copied. Time-locking controls the app, not memory. Opening a scheduled item also needs a connection to our server during its window.
- Lost master password and lost Recovery Kit. If you lose both, your data cannot be recovered by anyone, including us. This is the price of having no back door.
Recovery
At setup you save a Recovery Kit, as a text file or a QR code. It holds a recovery key that can unwrap your account key, so you can set a new master password if you forget the old one. Using it also removes any passkey unlock you had set up, so you'll re-add those afterwards. Keep the kit somewhere safe and offline, away from the device it protects.
There is no administrator override on any plan. A Family organiser or Business admin cannot recover another member's data. Shared vaults are the way to make sure a team keeps access to what it needs.
More detail: Your Recovery Kit and What we can and cannot see.
Reporting a vulnerability
If you've found a security problem, please tell us through the contact form and put "security" in your message. We'll prioritise it.
Move your passwords, notes and calendar into one private home.
Try every part of Atrium free for 14 days. No card, nothing charged when the trial ends, and your notes and calendars export in open formats.