Security
How GossipSeal protects your data, what it does not protect against, and how to report issues.
What is encrypted and where it happens
Files are sealed in the browser or desktop app before upload. The server stores ciphertext only. Filenames are encrypted too. There is no vendor-hosted tenancy; the operator runs a single Rust binary with SQLite and a blob store on local disk.
Cryptographic primitives
Hybrid X25519 + ML-KEM-768
A NIST post-quantum standard paired with a widely deployed elliptic curve algorithm.
AES-256-GCM
Streamed in 64 KiB chunks. Authenticated and encrypted simultaneously.
Argon2id
Configured with the OWASP 2024 parameters, which are chosen to make GPU cracking expensive.
Threat model
| Attacker has access to... | They can see... |
|---|---|
| Server disk or blob store | Encrypted ciphertext only. No content, no filenames. |
| The network between client and server | Encrypted transport (handled by your reverse proxy). They cannot read the payload. |
| A stolen laptop or desktop machine | Everything, if the user's password is known or the keystore is unlocked. GossipSeal cannot prevent local compromise. |
| One administrator, acting alone | File sizes, upload and download timing, and who shares with whom. They cannot read content or filenames. One recovery share alone reveals nothing. |
| Two of the three recovery shares | Everything. Two shares reconstruct a user identity and decrypt that user's files. This is the deliberate break-glass path, and it is why the three shares are held by different people and stored apart. |
| A future quantum computer | An adversary recording ciphertext today and waiting for a quantum computer gets nothing, because the key encapsulation is hybrid X25519 plus ML-KEM-768 and breaking it requires breaking both. |
What is deliberately not protected
- The server observes file sizes, upload and download timing, and the social graph of who shares with whom. Content and filenames are encrypted. That metadata is not.
- The server does not terminate TLS itself. Transport security is the reverse proxy's job.
- If a user loses both their keystore and their password and the organisation did not configure break-glass recovery, their data is unrecoverable. There is no password reset.
- Anyone holding two of the three recovery shares can reconstruct user keys. An admin can replace the recovery identity and reissue three new shares if one is compromised, but the three shares of a given identity cannot be rotated individually, only replaced together.
Enterprise features
GossipSeal supports OIDC single sign-on, SCIM provisioning, roles, groups, policies, an audit log with CSV and JSON export, and seat licensing. Sessions use hashed bearer tokens with an expiry.
Break-glass recovery
Recovery is optional and uses 2-of-3 Shamir secret sharing. Three shares are generated offline and held by different people. Any two can reconstruct a user identity. No single administrator can do it alone.
Responsible disclosure
Please report security issues to security@gossipseal.com. We aim to acknowledge reports within 3 business days.
There is no bug bounty programme at this time.
Note: The software has not had an external cryptographic audit.