chronolipi
Security architecture
Read this if you are going to trust us with evidence
This is the page we would want before putting a district’s land records into a vendor’s hands. It states what is built, what is designed but not yet audited, and where the residual risk genuinely lives.
What we can and cannot see
- File size, page count, timestamps
- Which workspace and which user
- A SHA-256 fingerprint of every blob
- Whether a document was opened or exported
- Contents of any document
- Your passphrase or any unwrapped key
- Text read in your browser — it is sealed before it leaves
- Anything marked “no indexing” — at all
Metadata is not a secret we keep from you: we list it because zero-knowledge claims that ignore metadata are marketing.
Six layers
Defence in depth, with the weak part named
Each layer is a different failure mode. A single perfect layer is worthless; six layers with one honest caveat is how you actually sleep.
Layer 1 · Transit
- TLS 1.3 only — 1.2 and below are refused at the edge, no fallback
- Certificate pinning in the Android and iOS apps; OCSP stapling on the web portal
- HSTS with preload, so an http:// typo never sends a filename in the clear
- Payload already encrypted before it leaves the device, so a broken TLS stack is not a data breach
Layer 2 · At rest
- AES-256-GCM per file; the AEAD tag means a modified blob fails to decrypt
- File keys wrapped by a key-encryption key derived from your passphrase with Argon2id (64 MiB, 3 passes)
- Only wrapped keys, IVs and sealed records in the database; nothing in it opens a file
- Nightly backups encrypted again with a separate backup key (AES-256-GCM) before they leave the server
Layer 3 · Processing
- OCR runs in your browser by default: no server reads a page unless you ask it to
- Server reading is opt-in per document, asked in plain words and recorded in your audit trail
- Pages are sealed to the reader's own key — our API, network and any proxy relay ciphertext only
- The reader: a fresh process per job, no disk writes, no swap, no core dumps, no network beyond the machine
Layer 4 · Access
- Zero-knowledge: no service account in our platform can turn your stored bytes into a document
- Two-step login: a 6-digit code from an authenticator app after the password; an office can require it for everyone
- A device remembers you only if you ask (30 days at most); Log out forgets it, and so does a password change
- Roles per folder, auditors with an end date, and (Enterprise) a network allowlist and shorter sessions
- Session timeouts, visible device list, one-click revoke-everything
Layer 5 · Integrity
- SHA-256 of every blob at upload, and of every derived file after processing
- Re-verified on open; a mismatch blocks the view and raises an alert to you, not us
- Append-only audit log — records, never updates — retained 12 months online, 7 on request
- Every activity entry is chained to the one before it, so a removed or changed entry shows
Layer 6 · Legal & process
- DPDP Act 2023: consent, purpose limitation, erasure on request, breach notification duties
- Data processed and stored in India; region pinned on Enterprise
- Two-person rule for infrastructure changes; no engineer can enter your workspace unlogged
- Independent pen test annually, findings summary published here when it exists
The pipeline, step by step
Where your plaintext exists — all twelve moments
Plaintext lives on your device — and, only for a page you choose to send for AI reading, briefly inside one sandboxed reader. Everywhere else it is sealed. Anything that does not fit that sentence is a bug in our documentation, not in your reading.
- Phone / browserflatten, clean up, OCR, AES-256-GCM
- Upload servicesize + magic bytes, SHA-256
- Queuedurable, at-least-once
- Sealed readeronly for pages you send: RAM only, sealed back
- Storagesealed files + database, encrypted backups
- Searchin your browser, by meaning
crypto.getRandomValues() — one key, one file.AES-256-GCM(fileKey, KEK). The sealed key is what we store.[12-byte IV | ciphertext | 16-byte tag] and the readable original is wiped from memory.Threat model, honestly statedThe one honest exception — and it is yours to make. Reading happens in your browser, so indexing does not need our servers to decrypt anything. For handwriting or damaged paper you may choose “Deep read” or “AI read” for a document, and “Ask AI” writes a summary, a letter or an answer from a document's text; the sandboxed program on our own server then sees that page or text in memory while it works, and keeps nothing. It is asked each time, never on by default, logged without content, and an office can switch AI help off entirely. If a document must never be seen by any machine we control, never choose these for that document.
Try it here
Encrypt a sentence the way your deed gets encrypted
This form runs the real envelope — a per-file AES-256-GCM key, sealed with a key derived from a passphrase — using your browser’s Web Crypto API. This form makes no request: no fetch, no XHR, no analytics. Open the network tab before you press the button and watch it stay empty.
BLOB YOUR SERVER RECEIVES (BASE64)
SHA-256 of the blob
Size effect
Key derivation
Owner-side recovery
Tamper test
Re-run it: the blob changes every time, because both the file key and the IV are freshly random. Deterministic ciphertext would leak which of your documents are identical.
Honest numbers
What the system does, stated as engineering
We are early. Rather than invent customer counts, here are the numbers we control — measured properties of the software, not marketing.
AES-256-GCMthe cipher used per file; authenticated, so edits break decryption
14 languagesOCR models bundled; Odia and Hindi get the most attention
512-tokenchunks before embedding, so search answers cite a paragraph, not a PDF
0bytes of plaintext written to disk in the processing path
12 monthsof append-only audit log kept per workspace
₹0for the first 50 pages every month
What we deliberately do not claimWe do not claim customer counts, uptime SLAs or certifications we have not completed. When a third-party audit exists, it will be linked from this page — not promised here.
Threat model
What breaks, what it costs you, what we do about it
Written the way a CISO wants it: adversary first, control second, and residual risk admitted.
| If this happens | What you lose | Where we stand |
|---|---|---|
| Someone steals an S3 bucket or a backup tape | They get ciphertext. Per-file AES-256-GCM with keys they do not have. Cost to you: nothing, except a loud page to our on-call. | Mitigated by design |
| A rogue employee with production access | No path from their credentials to your file keys. Keys are unwrapped on your device; an employee can read metadata (file size, timestamps, your plan) but not contents. The one exception: someone with administrator rights on the reading server could watch a page you chose to send for server reading while it is being read. | Mitigated by design · one stated exception |
| A lawful demand for your documents | We can hand over ciphertext and metadata we are legally able to describe; we cannot hand over readable plaintext, so we will tell whoever asks that, in writing. | Architecturally limited |
| The reading server is compromised mid-job | It can see the pages you chose to send for server reading, briefly, in RAM. It has no network beyond the machine, no disk writes, and each job runs in a fresh process that ends with it. Documents you read in your browser — the default — never enter this path at all. | Residual — stated |
| Someone between you and the reader swaps in their own key | Pages for server reading are sealed to the reader’s key, and that key is signed by the reader’s long-term signing key. Your browser remembers the signing key the first time and refuses to send a page if it ever changes. Not covered: someone who can also change the app’s own code on our domain. | Mitigated · limit stated |
| You forget your passphrase | Nobody can help you read those files. The printed recovery kit is the only door. We deliberately did not build a password reset that bypasses the key. | By design, on you |
| A nation-state compels our KMS or CA | They can force availability and metadata disclosure; recovering plaintext still requires your wrapped keys, which exist only on your devices and your recovery kit. If that is your actual adversary, run the VPC-only deployment. | Residual — mitigated |
| Someone edits a scanned deed before a dispute | One flipped byte changes the SHA-256 and breaks the GCM tag; the open fails rather than lying to you, and the log shows who tried. | Detectable |
Compliance
Status, not aspiration
The industry habit of writing “HIPAA ready” next to a checkbox nobody has opened is how trust dies. So this table has a Not claimed row.
| Framework | Status | What that actually means |
|---|---|---|
| DPDP Act, 2023 (India) | Implemented now | Consent records, purpose tagging, erasure within 30 days, breach notification runbook, data fiduciary contract terms. |
| IT Act §43A reasonable security | Implemented now | AES-256-GCM, access controls, logging and an incident process are the practices the rules describe. |
| Electronic evidence (Section 63, BSA 2023) | Supported | Court copy pack: fingerprint, times, custody record and a draft Section 63 certificate. |
| GDPR | In progress | Design aligns (data minimisation, encryption, portability, erasure); an EU representative and DPA template are not yet in place, so we do not sell to EU controllers today. |
| HIPAA | Not claimed | Security-rule controls are largely shared, but no US Business Associate Agreement is signed. Ask us if you need one — we will say no until it is real. |
| SOC 2 Type I | Roadmap — not started | Not audited. Do not quote this page as evidence of one. |
| ISO/IEC 27001 | Roadmap — not started | An ISMS is planned after the first enterprise deployments; no certificate exists. |
One more honesty noteChronolipi is a records platform, not a law firm. Where a framework matters to your contract, we will co-sign the addendum if the controls exist — and decline if they do not.
Trust centre
Operational facts a security questionnaire asks for
Reporting a vulnerability
Write to security@chronolipi.com with a PGP key available on request. Acknowledgement within 24 hours, triage within 3 business days.
- No legal action against good-faith research on this domain
- Safe harbour for research that does not touch another tenant’s data
- Reward: ₹10,000–₹2,00,000 by severity, paid in rupees, no NDA gag
- Please avoid: social engineering of staff, load tests, physical access attempts
Incidents, in advance
If your ciphertext is exposed — bucket policy, key custody, worker compromise — you hear from us in writing within 24 hours of confirmation, with the affected hash list, and we notify DPDP authorities on the statutory timeline.
- Post-incident report published here, redacted for other tenants
- Encryption-only exposure is stated as such — no inflation, no euphemism
- Your workspace’s log is exportable to your own SIEM for the same window
Who else touches your data
Sub-processors, named: our server host in India, an off-site backup store (which receives only backups encrypted with a key it never sees), an email provider, and — only if you turn on reminder messages or pay online — WhatsApp (Meta), an SMS provider (MSG91) and Razorpay. None receives a file key, and reminder messages never say what a paper is.
Deletion, and what survives it
Deleting a document removes the blob, the metadata row, the embeddings and the OCR artefacts within 30 days, including from backups as they roll off. The SHA-256 receipt stays — a hash of a deleted file reveals nothing and is what proves the deletion happened on time.
Due diligence
Security questions we are asked in procurement
Where exactly are my files stored, and in which country?
Object storage and databases run in India; on Enterprise you pin the region and we contractually commit not to move it. Processing happens in the same jurisdiction. If a future requirement ever forced a change, that is a breach of the addendum, not a silent ops decision.
Do you use AI on my documents, and does it train on them?
Embeddings are computed for your search index and nothing else. Your text is never used to train a shared model, and if you route LLM answers through a third-party model we send only retrieved chunks over a private endpoint, with your consent recorded. On Enterprise, inference runs in your VPC.
Can you hand over my documents to the police?
We can hand over what we hold: sealed ciphertext, and metadata we are permitted to disclose. Reading a file requires your passphrase, your recovery kit, or your own device — so a request for content gets a written explanation of why we cannot comply, which is also your protection.
How do you back up, if you cannot read anything?
Backups are copies of ciphertext plus wrapped keys. A restore is byte-identical: that is why we use AEAD rather than a cipher that merely hides — an unusable backup is worse than no backup in a records business.
What about the mobile app on a lost phone?
The app holds no long-lived key material in its sandbox beyond a keychain-wrapped session token; a lost device is revoked from another session in one tap, and certificate pinning stops a rogue access-point swap of the upload endpoint.
Get started
Want this as a signed document?
The security pack is this page plus the pen-test summary, the DPDP addendum, the incident runbook and a completed questionnaire — sent within two business days.