Security Whitepaper
A detailed overview of how QuillFox protects your most sensitive thoughts and tasks using true Zero-Knowledge Architecture.
1. Master Key Derivation
Your encryption keys are derived entirely on your device using your passcode. We use PBKDF2 with 600,000 iterations and SHA-256 to derive a robust AES-256-GCM symmetric master key. This ensures your key is highly resistant to brute-force attacks and authenticated against tampering.
2. Zero-Knowledge Server
Our Supabase backend only stores the encrypted ciphertext of your notes and tasks, along with the Initialization Vector (IV). The master key itself is encrypted using your user password via PBKDF2 key derivation before being synced.
Master Key resides here
Cannot read payload
3. Secure Collaboration (Workspaces)
When you invite someone to a workspace, QuillFox encrypts the workspace's symmetric key using the invitee's public key (RSA-OAEP). The invitee then decrypts it locally with their private key, ensuring seamless E2EE collaboration without compromising the zero-knowledge guarantee.