Anything that touches plaintext is open source
The encryption engine, the daemon, and every language package can see secrets in plaintext - so all of them are MIT-licensed and auditable before any sales conversation. No NDA, no trust-us.
Audit the code, not the marketing
Kryptic's security model is designed to be verified, not believed: everything that can see a secret in plaintext is open source, and the server-side platform only ever stores ciphertext.
Principles
The rules the architecture is built on
No custom cryptography
AES-256-GCM from platform crypto libraries and proven Argon2id implementations, composed - never reimplemented. The engineering lives in the key hierarchy, envelope format, and rotation behavior.
Secrets never leave the server unencrypted by accident
The database only ever contains ciphertext envelopes and wrapped keys. Values are decrypted on explicit, authorized, audit-logged operations - and audit logs record actions, never values.
Memory-only on the client
The daemon holds secrets in memory with a 5-minute TTL and serves them over a local OS socket that never crosses a network. Nothing is written to disk on developer machines.
Cryptography
What protects your secrets
At restEnvelope encryption: each organization has its own 256-bit data key, wrapped by a platform master key. AES-256-GCM, 96-bit random nonces, 128-bit tags.
Context bindingEvery ciphertext is bound to its secret and environment via associated data - rows cannot be swapped in storage undetected.
Key rotationOrg data keys rotate with full re-encryption in one transaction; the platform master key rotates by rewrapping data keys with zero secret re-encryption.
Passwords & machine secretsArgon2id (64 MiB, 3 iterations), versioned parameters, constant-time verification. Refresh and invitation tokens are stored only as SHA-256 hashes.
In transitTLS 1.3 to the platform; local daemon-to-package delivery over a unix socket (macOS/Linux) or named pipe (Windows) with user-only permissions.
Sessions15-minute access tokens, rotating refresh tokens, org-configurable absolute session expiry, per-device revocation.
Verify it
The open-source boundary
The encryption engine ships with a SECURITY.md describing the full key hierarchy - what is derived from what, where each key lives, and exactly what the server can and cannot see - plus the test vectors that prove it. The daemon and all six language packages (.NET, Node.js, Python, Java, Go, Ruby) are MIT-licensed in the same organization.
Read the code on GitHubDisclosure
Reporting a vulnerability
Report suspected vulnerabilities to [email protected]. We acknowledge within 48 hours, keep you informed while we fix, and credit reporters who want to be credited. Please do not open public issues for security reports.