Reference

Glossary

Concise definitions of the terms used across Rhea. Additional terms are added alongside the articles that introduce them.

Access control: The rules and mechanisms that decide which identities may perform which actions on which resources.
Address (blockchain): A public identifier derived from a public key. It can be used to reference a cryptographic account without exposing its private key.
AES: Advanced Encryption Standard. A symmetric block cipher standardized by NIST and used inside AES-GCM.
AES-GCM: An authenticated encryption mode combining AES with Galois/Counter Mode. Produces ciphertext plus an authentication tag so tampering can be detected.
Authentication: Proving that a request comes from a specific identity. In Rhea, this is done cryptographically through a signature, not a password.
Authorization: Deciding what an authenticated identity is allowed to do. Rhea Data evaluates authorization independently of authentication.
Available: Shipped and usable by customers today, with no additional access required.
Approval: Available. A human authorization for a sensitive action, signed through Rhea Key on the user's device.
Application interface — Planned: Planned. Intended to let authorized applications request narrowly scoped Rhea Data operations under organizational policy and audit. Not currently available.
Agent interface — Planned: Planned. Intended to let controlled software agents request narrowly scoped Rhea Data operations under organizational policy, required human approval and audit. Not currently available.

BYOD (Bring Your Own Database) — Planned: Planned. Intended to run the database that indexes protected records inside infrastructure the customer owns and controls. Not currently available.
BYOS (Bring Your Own Storage): Available. Writing encrypted objects to storage the customer owns and controls. Rhea Data connects AWS S3, Microsoft Azure Blob Storage, Google Cloud Storage, Oracle Cloud Object Storage, Cloudflare R2 and MinIO or other S3-compatible stores.

Ciphertext: Available. The output of an encryption operation. Unreadable without the correct key. Only ciphertext is uploaded to connected storage.
Client-side encryption: Encrypting data on the user's device before it leaves for storage or transit, so the destination service never sees plaintext.
Cryptographic account: An account whose control is proven by possession of a private key, not by an email-and-password credential stored on a server.
Cryptographic authorization: An authorization decision anchored to a cryptographic signature, so approval cannot be forged by a server-side credential leak.
Coming soon: Not yet available, but scheduled for near-term release ahead of longer-range planned items.
Cryptographic authentication: Available. Proving control of an account through a signature produced by a private key, rather than through a stored password.

Digital signature: A value produced with a private key that anyone with the matching public key can verify. Proves authorship and integrity.
Direct storage path: The normal path, where Rhea Data connects directly to the organization's BYOS storage.
Data-encryption key: A per-document symmetric key used to encrypt that document's content. Wrapped for each authorized recipient rather than shared in the clear.

Encryption: Transforming data so only holders of the correct key can recover it.

Key custody: Where private keys are held and who can use them. Under Rhea Key, custody stays with the user.

Metadata: Data about data — identifiers, timestamps, sizes, references. Distinct from the protected content itself.

Nonce: A number used once. In AES-GCM it must be unique per key to keep encryption secure; in authentication it prevents replay.

Object storage: Storage that treats data as opaque objects addressed by keys, such as Amazon S3.
Operations: Rhea Data usage is based on the amount of data Rhea Data processes each month. This includes encryption, decryption and other processing performed by Rhea Data.
Operational metadata: Information Rhea Data and Rhea process to provide authorization, organization administration, metering, security and audit functions — such as identifiers, roles, sessions and usage records. Distinct from protected file content.
Organization role: Available. A named permission set assigned to a member of a Rhea Data organization — Owner, Admin, or Member.

Plaintext: The readable input to an encryption operation, or the readable output of a decryption operation.
Presigned URL: A time-limited URL that grants scoped access to a storage object without exposing long-lived credentials.
Private key: The secret half of a keypair. Signing and decryption require it; it must never be shared.
Public key: The shareable half of a keypair. Used to verify signatures and to encrypt to the keyholder.
Pairing protocol: An open protocol for pairing a signing surface (like Rhea Key) with an application over an encrypted channel, typically initiated by a QR code.
Planned: Planned. Intended for Rhea's roadmap. Not currently available and no public date is committed.

Rhea Data: Available. Rhea's enterprise data protection and management infrastructure — not a storage service. Encrypts client-side and stores in the customer's chosen infrastructure.
Reown signing kit: The signing-side software component that Rhea Key uses for its pairing protocol.
Rhea ID: Rhea's identity product. Returns signed Yes / No / Unknown answers to identity questions without transferring identity documents. Not required to use Rhea Data.
Rhea Key: Rhea's cryptographic access and authorization infrastructure, available on the web. The first factor and the authenticator for Rhea Data: a key the holder controls signs each action. Native mobile applications are coming soon.
Role: A named set of permissions assigned to a member of an organization — for example Owner, Admin, or Member.
Rhea Data relay: In some situations, data may be processed through the Rhea Data relay instead of the normal direct storage path.

S3: Amazon Simple Storage Service. Object storage widely used for cloud data. Supported today as a BYOS target for Rhea Data.
Session: A time-bounded connection between two parties — in Rhea Key, established over an open pairing protocol after QR pairing.
Signature: Shorthand for digital signature.

Wrapped key: A data-encryption key that has itself been encrypted ("wrapped") so only an authorized recipient's key material can unwrap and use it.

Zero Trust: A security model that assumes no implicit trust based on network location and evaluates each request on its own merits.