Protected documents
One place for the files you cannot afford to lose control of.
Folders, search, filters and per-item actions over documents that are encrypted on the device before storage receives them.
What happens on upload
Protection happens before the file leaves the device.
- 01
A key is generated for the document
Each document is protected with its own data encryption key, wrapped by key material derived from the organization's authority.
- 02
Contents are encrypted with AES-256-GCM
Encryption happens in the browser, in 5 MB chunks, each with its own random 96-bit initialization vector.
- 03
Each chunk is bound to its document and position
Reordering, splicing, duplicating or substituting chunks in the bucket is detected when the document is opened.
- 04
Your storage receives protected objects
The connected AWS S3 environment stores ciphertext. Anyone inspecting the bucket sees protected objects.
- 05
Opening requires authorization
Decryption is gated by short-lived, limited-use, revocable authorization, and the document is decrypted on the authorized device.
In the product
The document workspace.
Boundaries
What this does and does not cover.
- File contents are encrypted on the device before storage receives them.
- Filenames, folder names and MIME types are stored as plaintext metadata today. Encrypted metadata is planned.
- An Owner or Admin role does not grant the ability to decrypt another member's document.
- Once a document is decrypted by an authorized user, RED does not control the plaintext on that device.
LimitationFilenames and folder structure are visible to Rhea and to anyone with administrative access to the database today. Encrypted filename and folder metadata is planned, not shipped.
See it against your own environment.
Connect your own storage, protect a document, and read the recorded evidence yourself.