Skip to content
Graphophone

Built like a vault

Security & cryptography

Graphophone stores your most personal writing. The crypto stack reflects that — peer-reviewed primitives, defense in depth, and a vault format that survives offline forensic analysis.

The crypto whitepaper Third-party licenses →
A new journal's welcome screen, with the lock button in the top-right corner.

Primitives

The stack

  • Argon2id (passphrase → KEK)

    OWASP-recommended parameters at vault creation, persisted in the header so future tuning never breaks an existing vault.

  • XChaCha20-Poly1305 AEAD

    Per-entry sealing with a fresh 192-bit random nonce. Tampered or replayed envelopes fail authentication on open.

  • HKDF-SHA256 subkeys

    Distinct labeled keys for per-entry sealing, attachment blobs, entitlement, sync, backup, and the SQLCipher whole-database key.

  • Independent recovery wrap

    The master key is wrapped twice — passphrase and recovery code — under domain-separated AAD strings so swaps are detected.

  • Content-addressed attachments

    Photo / audio plaintext bytes are sealed under a per-blob nonce keyed by BLAKE3 content hash; the AAD includes that hash for binding.

  • Shamir Legacy mode (GF(2^8)) (coming)

    Split your master key among trusted contacts. Any k of n shares reconstruct it. Fewer than k reveal nothing.

Defense in depth

Defensive properties

  • The vault header is independently parseable; an attacker who gets only vault.db cannot decrypt without the header AND the passphrase.
  • Cross-entry swaps are detected because the entry UUID is bound into the AEAD AAD.
  • Recovery-by-code does not weaken passphrase security: each wrap has its own AAD label and nonce.
  • Wrong passphrase, wrong recovery code, and tampered ciphertext are intentionally indistinguishable at the API boundary to avoid leaking which step failed.
  • Per-tag AI access controls cap #private / #medical / #therapy entries to on-device models unless you explicitly opt in to your own model server; #no-ai is absolute and enforced in the core.
  • Graphophone shows no advertising on any tier. There is no ad SDK, no ad network, and no endpoint contacted for one — so there is no ad request that could carry an identifier.
  • When the app leaves the foreground the vault auto-locks — after a 30-second grace by default, which absorbs quick app switches without making you unlock again, and which Settings → Auto-lock changes to immediate, 1 minute or 5 minutes. So an open journal is not left readable for whoever next picks up the device, and past the grace it is the unlock screen they get. Transient inactive events never trigger it, the lock decision is settled before any content is drawn on the way back in, and a privacy shade covers your writing in the app-switcher preview whichever setting you choose.
  • Opt-in biometric unlock (Face ID / fingerprint) stores your passphrase in the OS secure keystore behind a biometric prompt, on top of your passphrase and recovery code, and is torn down automatically on passphrase change or panic wipe.

The details

Verify us — don't just trust us

Privacy claims are only worth what you can check. Here is what you can read today:

Still to come

On the roadmap to v1.0

One trust milestone we have not reached yet, and won't claim until we have: an independent third-party security audit, with the report published here. Until then, the crypto whitepaper above is the full specification of what ships.

Reporting a vulnerability. Email security@graphophone.app — the same address published in our security.txt, and the one the support page means when it sends you here. Please report privately, so a fix can ship before the details do. General questions, and anything that is not a vulnerability, are welcome at hello@graphophone.app.