Sealed by design.
This is the trust page. It says what the suite protects, how, and what it does not protect. Read the limits first if you are skeptical; that is where the honesty is.
Zero-knowledge, defined
Zero-knowledge here means one thing: no system we operate ever holds a key that can open your vault, so there is nothing we could read, leak or be compelled to hand over. Every vault key is derived on your device from your passphrase with Argon2id and kept there. The apps, the Icebox and the Bedrock engine all run on your machine.
Encrypted at rest
SQLCipher (AES-256) for structured data; an authenticated encrypted blob store for files and attachments. Nothing in the Icebox is ever written in the clear, including search indexes.
One engine
All cryptography, key handling, storage, sync, mail and messaging live once, in the Rust core, and are shared by every app. One place to audit, one place to get it right.
Never leave
Keys are generated locally and never transmitted. Multi-device sync moves ciphertext and re-wraps keys device to device, never through a server.
The blast door: zero outbound
The suite opens no connection you did not ask for. No telemetry, no update pings, no crash reports, no font or icon fetches, no "anonymous usage statistics". The only network traffic is the traffic you cause: Dispatch talking to your mail server, Relay delivering a message through an Outpost, Periscope loading a page you typed.
Every build runs under an automated network capture with every app open and every feature exercised. If one packet leaves to a destination the test does not expect, the build fails. The capture summary ships with each release so you can check it yourself.
Sync and messaging: the Outpost
Some things inherently need a peer. For those, ColdBunker uses an Outpost: a store and relay server you run yourself or subscribe to from Net-Com. Devices encrypt before they send; the Outpost receives ciphertext and the small header each vault needs in order to sync, and passes them along.
- Receives
- Encrypted blobs; vault headers (vault id, creation time, Argon2id parameters); encrypted Relay messages addressed to a vault id.
- Never receives
- A key, a passphrase, or readable content of any kind.
- Can observe
- Which vault ids exchanged how many bytes, and when. Standard traffic metadata for any relay.
The honest limits
- Vault headers are not secret. An Outpost holds the header it is sent, and a header can be used to try passphrases offline. A long passphrase makes that attack impractical; the app enforces a minimum and tells you how strong yours is.
- Browser site data is not in the vault. Cookies and localStorage are kept by the operating system's webview, which the vault cannot encrypt. Periscope's history and bookmarks are zero-knowledge; its cookies are not. Clear them from Periscope at any time.
- Mail to outsiders is only as private as they are. PGP is automatic between Bunker users. To anyone else it is opt-in, and your mail server sees what any mail client would show it.
- Relay metadata exists. An Outpost can see that two vault ids exchanged bytes. It cannot see what the bytes say.
- Your machine is the perimeter. Malware with access to your unlocked session can read what you can read. The vault protects data at rest and in transit; it is not an antivirus.
What "cannot" means
Everywhere on this site, "we cannot read it" is literal. It is not a policy that could change with a new terms-of-service. There is no key on our side to turn over, under a subpoena, a court order or anything else. The published threat model on the legal page spells out the adversaries we design against and the ones we do not.