Privacy and Encryption
What Memora can and cannot see when you attest a document, how keys are held, what reaches the Canton Network, and what is independently reviewed.
Your browser hashes and encrypts documents before anything leaves your machine. We store ciphertext and proofs, never your unencrypted content or a key that can decrypt it. The document's hash and the metadata you choose to anchor reach the Canton Network. The content does not.
What Memora can and cannot see
| We can see | We cannot see | |
|---|---|---|
| Document content | The plaintext of any document. We receive only ciphertext. | |
| Document keys | Wrapped key material that cannot be unwrapped without your passkey or recovery code | Any usable key |
| Hashes | The SHA-256 hash of each document, which is anchored on Canton | The content the hash was computed from. A hash cannot be reversed |
| Metadata | Fields you mark for on-chain anchoring, disclosed to the parties you name | Fields you keep off-chain, which are encrypted with the document |
| Activity | Who uploaded, shared, revoked and when, in an append-only audit log |
How encryption works
In the browser
When you upload, the app computes the document's SHA-256 hash and encrypts the file with AES-256-GCM using a key generated for that document. Only the encrypted file and the hash leave your machine.
Key custody
A vault key wraps each document key, and only two things can unlock it: your passkey, through the WebAuthn PRF extension, and your printed recovery code. We store only wrapped key material, so you can use your keys on a new device without us holding an unwrapped key. There is no server-side escrow that can decrypt.
Sharing
Sharing a document with someone re-wraps its key to their public key, so only they can unwrap it. We never receive a key we could use to decrypt the document.
Public keys
Since we serve the public keys used for sharing and recovery, a compromised server could try to substitute one. The app pins each contact's key on first use, shows a safety number you can compare out of band, and blocks sharing with a hard warning if a key changes.
Workspace recovery
When a workspace admin enables recovery, the app seals the recovery private key to that admin's own passkey. Recovery, decryption and download happen in the custodian's browser. We still cannot decrypt.
What reaches the Canton Network
Only two things are anchored on-chain: the document's hash, and the metadata fields you chose to anchor. The encrypted file itself is stored off-chain and never written to the ledger.
Canton's privacy model means anchored data is not broadcast. A party sees a contract only if it is a stakeholder in it. When you disclose a field to a named party, that party sees it and no one else does. No one can see that the document exists unless you have named them.
Off-chain storage
Encrypted files are stored off-chain and identified by content address. Because the ledger holds the hash, the integrity of the stored file is checked against the ledger whenever it is read, and tampering is detected.
Authentication and sessions
Sign-up is passkey-mandatory. Sign-in is passkey-first with a password fallback. The fallback signs you in but cannot unlock documents on a new device without a passkey or the recovery code. Sessions use a cryptographically random token in an HTTP-only, same-site cookie, and you can sign out of every device at once from Settings.
Independent review
The application has undergone an independent security assessment covering authentication and sessions, authorization and tenant isolation, injection and request forgery, cryptography and secret handling, and web and denial-of-service hardening. We resolved the findings, including cryptographically random session tokens, tenant-scoped document queries, an append-only audit log, hardened document rendering, authenticated downloads, security headers and rate limiting on authentication. We retired legacy management endpoints that did not meet the same standard.
Limits
- If you lose every enrolled passkey and your recovery code, and your workspace has not enabled recovery, your documents cannot be recovered by anyone.
- Workspace recovery currently covers documents uploaded after it was enabled, has a single custodian, and does not rotate keys. The app shows these limits where they apply.
- Documents ingested automatically from a connected DocuSign account pass through our servers to be hashed, so they are not end-to-end encrypted in the same way as manual uploads. This is an explicit, per-customer opt-in. See DocuSign Integration.
- Key verification is client-side only. There is no server-backed key transparency log.
Questions
To report a security issue in the attestation product, email inquiries@memora.systems.