Encryption
When you use Omnodex’s cloud features (Hosted tier and above), your data is protected by zero-knowledge end-to-end encryption. This means the Omnodex service never has access to your unencrypted data.
How It Works
Section titled “How It Works”When you create a data stream in the dashboard, you choose a passphrase. This passphrase is used to derive an encryption key on your machine using Argon2id (a memory-hard key derivation function). Events are encrypted with AES-256-GCM before leaving your machine, and only ciphertext is transmitted and stored in the cloud.
When you sign in to the hosted dashboard, your browser retrieves your encrypted key material and decrypts it locally using your account password. The server never sees your passphrase or encryption keys in plaintext.
Key Hierarchy
Section titled “Key Hierarchy”Omnodex uses a layered key-wrapping architecture inspired by Bitwarden’s zero-knowledge model:
- Passphrase: you choose this when creating a data stream. It is used by the CLI to derive the encryption key for that stream’s events.
- Master wrap key: a random 256-bit key generated during account registration. It encrypts your per-stream passphrases so they can be stored server-side (as ciphertext).
- Wrap key: derived from your account password + a per-user salt using Argon2id. It encrypts the master wrap key. This is how your password unlocks your passphrases without the server knowing any of them.
- Recovery wrap key: derived from a one-time recovery key shown at registration. It independently encrypts the same master wrap key, providing a backup path if you forget your password.
The server stores only the encrypted forms (ciphertext + IV) of the master wrap key and per-stream passphrases. At no point does it hold plaintext keys or passphrases.
Key Derivation
Section titled “Key Derivation”Omnodex uses Argon2id for all key derivation, the current best-practice algorithm for password-based key derivation. It is memory-hard (resistant to GPU and ASIC attacks) and tuned for security while remaining fast enough for interactive use.
The derived keys are used for AES-256-GCM authenticated encryption.
Streaming Key Derivation
Section titled “Streaming Key Derivation”For live streaming (real-time event relay), a separate streaming key is derived using a two-stage process:
- Master key: Argon2id with the same passphrase but a fixed streaming-specific salt (~275ms, computed once per session)
- Streaming key: HKDF-SHA256 with the master key and your customer ID as context (sub-millisecond)
This ensures the streaming key and sync blob key are cryptographically independent even though they derive from the same passphrase. Each encrypted event frame includes a key_id (truncated hash of the key) so the browser can verify it’s using the correct key.
What This Means in Practice
Section titled “What This Means in Practice”- If you lose both your password and recovery key, your cloud data is unrecoverable. We cannot reset it, decrypt it, or help you access it. This is by design.
- We cannot comply with data requests for your content because we do not have the ability to decrypt it.
- A breach of our cloud infrastructure would expose only ciphertext: encrypted blobs that are computationally infeasible to decrypt without your credentials.
Encryption Scope
Section titled “Encryption Scope”| Data | Encrypted? |
|---|---|
| Event payloads (tool calls, parameters, results) | Yes |
| Session metadata | Yes |
| Detection findings | Yes |
| Per-stream passphrases (stored in account) | Yes (wrapped by master key) |
| Account email / billing info | No (needed for service operation) |
| Usage metrics (event counts) | No (needed for billing) |
Browser Dashboard
Section titled “Browser Dashboard”The hosted dashboard decrypts data in your browser. When you sign in, your browser derives the wrap key from your password, decrypts the master wrap key, then uses that to decrypt your stream passphrases. From there, the stream passphrase is used to derive the decryption key for your event data. The decryption keys are never sent to the server.
Password Changes and Recovery
Section titled “Password Changes and Recovery”When you change your password, the dashboard re-encrypts the master wrap key under a new wrap key derived from your new password. Your per-stream passphrases and event data are unaffected; only the wrapping layer changes.
If you forget your password, enter your recovery key to regain access. The recovery key independently decrypts the master wrap key, allowing the dashboard to re-encrypt it under a new password. If you have lost both your password and recovery key, your encrypted data is permanently inaccessible.
Next Steps
Section titled “Next Steps”- Data Handling - Storage and retention policies
- Security Model - Overall security architecture