Reference

Glossary

Concise definitions of the terms used across Rhea. Additional terms are added alongside the articles that introduce them.

Access control: The rules and mechanisms that decide which identities may perform which actions on which resources.
Address (blockchain): A public identifier derived from a public key. It can be used to reference a cryptographic account without exposing its private key.
AES: Advanced Encryption Standard. A symmetric block cipher standardized by NIST and used inside AES-GCM.
AES-GCM: An authenticated encryption mode combining AES with Galois/Counter Mode. Produces ciphertext plus an authentication tag so tampering can be detected.
Authentication: Proving that a request comes from a specific identity. In Rhea, this is done cryptographically through a signature, not a password.
Authorization: Deciding what an authenticated identity is allowed to do. RED evaluates authorization independently of authentication.
Available: Shipped and usable by customers today, with no additional access required.
Approval: Available. A human authorization for a sensitive action, signed on the user's device using Rhea Key or supported Trezor hardware.
Application interface — Planned: Planned. Intended to let authorized applications request narrowly scoped RED operations under organizational policy and audit. Not currently available.
Agent interface — Planned: Planned. Intended to let controlled software agents request narrowly scoped RED operations under organizational policy, required human approval and audit. Not currently available.

BYOD (Bring Your Own Database) — Planned: Planned. Intended to run the database that indexes protected records inside infrastructure the customer owns and controls. Not currently available.
BYOS (Bring Your Own Storage): Available. Writing encrypted objects to storage the customer owns and controls. RED supports AWS S3 today; additional providers are planned.

Ciphertext: Available. The output of an encryption operation. Unreadable without the correct key. Only ciphertext is uploaded to connected storage.
Client-side encryption: Encrypting data on the user's device before it leaves for storage or transit, so the destination service never sees plaintext.
Cryptographic account: An account whose control is proven by possession of a private key, not by an email-and-password credential stored on a server.
Cryptographic authorization: An authorization decision anchored to a cryptographic signature, so approval cannot be forged by a server-side credential leak.
Coming soon: Not yet available, but scheduled for near-term release ahead of longer-range planned items.
Cryptographic authentication: Available. Proving control of an account through a signature produced by a private key, rather than through a stored password.

Digital signature: A value produced with a private key that anyone with the matching public key can verify. Proves authorship and integrity.
Direct storage path: The normal path, where RED connects directly to the organization's BYOS storage. Data on this path is billed at the normal rate.
Data-encryption key: A per-document symmetric key used to encrypt that document's content. Wrapped for each authorized recipient rather than shared in the clear.

Encryption: Transforming data so only holders of the correct key can recover it.

Key custody: Where private keys are held and who can use them. Under Rhea Key, custody stays with the user.

Metadata: Data about data — identifiers, timestamps, sizes, references. Distinct from the protected content itself.

Nonce: A number used once. In AES-GCM it must be unique per key to keep encryption secure; in authentication it prevents replay.

Object storage: Storage that treats data as opaque objects addressed by keys, such as Amazon S3.
Operations: RED usage is based on the amount of data RED processes each month. This includes encryption, decryption and other processing performed by RED.
Operational metadata: Information RED and Rhea process to provide authorization, organization administration, metering, security and audit functions — such as identifiers, roles, sessions and usage records. Distinct from protected file content.
Organization role: Available. A named permission set assigned to a member of a RED organization — Owner, Admin, or Member.

Plaintext: The readable input to an encryption operation, or the readable output of a decryption operation.
Presigned URL: A time-limited URL that grants scoped access to a storage object without exposing long-lived credentials.
Private key: The secret half of a keypair. Signing and decryption require it; it must never be shared.
Public key: The shareable half of a keypair. Used to verify signatures and to encrypt to the keyholder.
Planned: Planned. Intended for Rhea's roadmap. Not currently available and no public date is committed.

RED: Available. Rhea's enterprise data protection and management infrastructure — not a storage service. Encrypts client-side and stores in the customer's chosen infrastructure.
Reown WalletKit: The wallet-side software component (formerly WalletConnect SDK) that Rhea Key uses to implement the WalletConnect protocol.
Rhea ID: Coming soon. Intended to establish verified identity or specific identity attributes for services that choose to require them. Not required to use RED today.
Rhea Key: Available (Web, Android). Rhea's cryptographic access and authorization infrastructure. Proves control of a cryptographic account and signs authorizations. Rhea Key iOS is coming soon.
Role: A named set of permissions assigned to a member of an organization — for example Owner, Admin, or Member.
RED relay: In some situations, data may be processed through RED relay instead of the normal direct storage path. Only that portion is billed at the relay rate (10×).

S3: Amazon Simple Storage Service. Object storage widely used for cloud data. Supported today as a BYOS target for RED.
Session: A time-bounded connection between two parties — in Rhea Key, established over the WalletConnect protocol after QR pairing.
Signature: Shorthand for digital signature.

Trezor: A hardware signing device that holds private keys inside a dedicated device so signing does not require exposing keys to a general-purpose computer.

Wallet: An application or device that holds private keys and signs on behalf of a cryptographic account. Rhea Key is a signing surface, not a cryptocurrency wallet product.
WalletConnect protocol: An open protocol for pairing a signing surface (like Rhea Key) with an application over an encrypted channel, typically initiated by a QR code.
Wrapped key: A data-encryption key that has itself been encrypted ("wrapped") so only an authorized recipient's key material can unwrap and use it.

Zero Trust: A security model that assumes no implicit trust based on network location and evaluates each request on its own merits.