Security & compliance posture

Engineered for environments where security is non-negotiable

Modern authenticated cryptography, federated identity, strict tenant isolation, and a tamper-evident audit trail — by design, from the architecture down to the cipher.

Cryptography

  • XChaCha20-Poly1305 authenticated encryption
  • Argon2id memory-hard key derivation
  • Hierarchical key management with per-tenant rotation
  • Native AWS KMS and OpenBao integration

Identity & access

  • MFA (TOTP), OIDC SSO, LDAP / Active Directory
  • RS256-signed tokens, encrypted sessions, instant revocation
  • Session fingerprinting and new-device alerts
  • Adaptive brute-force protection, granular RBAC with hierarchical ACLs

Data protection & privacy

  • Optional zero-knowledge, end-to-end encryption
  • Strict multi-tenant isolation
  • Anti-enumeration, timing-resistant authentication flows
  • Transport security headers (HSTS, frame & content-type protections)

Compliance enablement

  • Retention policies with automated classification
  • WORM immutability (governance & compliance modes)
  • Legal hold with reason and approver tracking
  • Tamper-evident audit trail with SIEM forwarding

These capabilities map to many of the technical controls relevant to frameworks such as GDPR, NIS2, and DORA, and standards such as ISO/IEC 27001.

Architecture & deployment

Modern, horizontally scalable, on proven open infrastructure

Stateless API servers behind a load balancer, a dedicated worker tier for background processing, and data and storage tiers that scale independently. Ciphertext and key material are never co-located.

Stateless API tier

Stateless application services run behind a load balancer and scale horizontally for high availability.

Worker tier

Background key-rotation re-wraps, retention enforcement, audit warehousing, and search indexing — off the interactive path.

Independent data tiers

PostgreSQL for metadata and keys, encrypted objects in S3-compatible storage, Redis, Manticore, and ClickHouse.

Deployment options: container-based, supporting cloud, on-premises, and air-gapped environments. Secrets can be supplied inline or via files and external key-management services, and the platform validates its security-critical configuration at startup to prevent insecure deployments.

Technical specifications

Under the hood

Symmetric encryptionXChaCha20-Poly1305 AEAD (24-byte nonce, 16-byte tag)
Key derivationArgon2id (memory-hard; ops=3, 64 MB memory)
Client-side compressionDeflate, applied before encryption
Key-wrapping KDFBLAKE2b-based, domain-separated
Integrity hashingBLAKE2b per block
Key hierarchyMaster Key → per-tenant KEK (versioned) → per-file DEK
Master key sourcesEnvironment secret, AWS KMS, OpenBao
Token signingRS256 JWT access tokens + rotating refresh tokens
MFATOTP (RFC 6238) with recovery codes
FederationOIDC (PKCE + state), LDAP / Active Directory
Encryption modelsTransparent server-side · password-protected client-side (zero-knowledge)
Storage backendsAmazon S3, S3-compatible storage, local filesystem
DatabasePostgreSQL
Cache / sessionsRedis
Messaging / tasksNATS with JetStream
SearchManticore Search (per-tenant isolation)
AnalyticsClickHouse
Large-file transferChunked, resumable upload/download with checkpoints
LocalizationEnglish, Spanish, French, Portuguese (i18next)
DeploymentContainerized; cloud, on-premises, air-gapped

Feature availability may depend on edition, configuration, and deployment. Specifications are subject to change.

Ready to evaluate SecureShare?

Talk to our team about a proof of concept, a self-hosted deployment, or your specific compliance requirements.

Request a Demo → Back to overview