GossipSeal Start subscription

How it works.

Four steps. The first one is the whole idea: a file is sealed on your computer before it goes anywhere. Everything after that is a server moving boxes it cannot open.

How a file moves through GossipSealOn your computer a file is sealed with a random key and the key is locked in an envelope. Your server stores the sealed file and the envelope but cannot open either. To share, a new envelope is sealed for a teammate, who opens it on their own computer.YOUR COMPUTERcontract.pdfthe real file, the real namerandom keyAES-256-GCM, 64 KB piecessealed file7f3a91c4e2d0… 2,318 Benvelopefile key, locked to your identityX25519 + ML-KEM-768YOUR SERVERstores:7f3a91c4e2d0… 2,318 Benvelope lockedwho may fetch itCannot open either oneA TEAMMATE'S COMPUTERnew envelopesame file key, sealed for themby you, on your computertheir keystore opens itpassword never leaves their devicecontract.pdfopened here, never on the serverOnly they can open it
The server, the network between, and Gossip Apps all see the same thing: a hash, a size, and a locked envelope.
1

The file is sealed on your computer

When you add a file, the app on your own machine makes a random key and locks the file with it (AES-256-GCM, in 64 KB pieces). The file name is locked too. Nothing has left your computer yet.

2

The key goes in an envelope only you can open

That random key is then locked to your identity with X25519 plus ML-KEM-768, the post-quantum standard. We call the result an envelope. Recording the traffic today and decrypting it with a quantum computer later does not work.

3

Your server stores things it cannot open

The sealed file and the envelope are uploaded to a server you run. It writes both to disk. It never sees the key, the file, or the name. All it holds is a hash, a size, and who is allowed to fetch it.

4

Sharing is one more envelope

To share with a teammate, your app opens the file key on your machine and seals it again for their identity. That new envelope goes to the server. They can open it; nobody else can, including the server and including us.

Where your keys live

Your keystore

Your identity is a small encrypted file on your device, locked with your password. The server never has the password and never has the identity, so there is no password reset. The apps push you to back the keystore up on day one, because losing both the file and the password loses your files for good.

Organization recovery

The safety net. Your admin creates three recovery shares offline. Any two of them, held by different people, can rebuild a recovery identity that opens every user's envelopes. One person alone cannot. Neither can we.

What runs where

Server

Your box

One binary. Sealed files plus a small database on local disk. Serves the two web apps below on port 8080. Put your own TLS in front.

Web vault

In the browser

Where staff sign in, upload, download, and share. All sealing runs in the browser (WebAssembly).

Admin console

In the browser

Users, seats, roles, policies, audit log, license, recovery, support.

Desktop app

Mac (optional)

Same job as the web vault, native. Windows and Linux on request.

License

A signed file

Seats, tier, expiry, signed by us. The server checks the signature offline. No phone-home.

Us

gossipseal.com

We sell the license and answer support. We hold no files, no keys, no passwords.

What we can and cannot do

We can

  • Issue and renew your license
  • Answer support requests by email
  • Tell you exactly what the server stores

We cannot

  • Read a file, a file name, or a key
  • Reset a password or rebuild a keystore
  • Recover a file for a user who lost both

That second list is the product. The full threat model, the primitives, and the things we deliberately do not protect are on the Security page.

Start subscription Talk to us