“This sentence matters.”
Encrypt locallyShared annotations.
Encrypted before
the relay.
Pro Preview: shared workspace content is designed to be encrypted before it reaches the relay. Presence and connection metadata remain readable to the relay. An external security audit has not yet been completed. These collaboration controls are not enabled in the basic Chrome edition.
Encrypted payload
7f9a21c48b73e05dWorkspace routing
7f9a21c48b73e05dNo readable annotationEncrypted payload
7f9a21c48b73e05d“This sentence matters.”
What the relay sees.
Encryption protects annotation content, not every piece of connection metadata.
Readable to the relay
- That a workspace exists
- Room identifiers and any presence state sent by clients
- Connection timing, volume, and IP address
Not readable to the relay
- Notes and highlighted text
- Drawn annotation content
- Workspace keys and decrypted payloads
The key stays with you.
In Pro Preview, workspace keys are stored in the browser profile without application-level encryption at rest. Shared annotations are also mirrored locally in readable form. An exported, password-protected key backup is encrypted, but it backs up keys, not annotations. Key-backup controls are not included in the basic edition.
Lose both, lose access.
If the original key access and recovery material are both lost, Quillcrypt cannot decrypt the workspace for you.
7f9a21c48b73e05d... inaccessible without the keyA careful boundary.
Designed to protect against
The relay or its persisted storage reading annotation contents.
Outside this protection
A compromised device, an unlocked browser profile, a collaborator copying content, or scripts on the webpage where annotations are rendered. Removing a member cannot erase content or keys they already copied.
Useful questions.
Can Quillcrypt recover my workspace key?
Quillcrypt does not hold a recovery key. In Pro Preview, a key backup or another authorized device or member may restore access. If all key copies and recovery material are lost, Quillcrypt cannot decrypt the workspace.
Are invite links secret?
Pro Preview invite links carry a workspace key in the URL fragment. Browsers omit the fragment from the initial HTTP request, but scripts on the destination page can read it. Anyone with the full link may obtain the key; share it only with trusted recipients. Workspace name and scope appear in the query string and may reach the link host and its logs.
Does the relay store updates?
It can persist opaque encrypted update history so an offline client can catch up. That storage still contains metadata and must be protected operationally.
Has Quillcrypt had an external security audit?
Not yet. The repository contains an audit scope, but internal automated verification is not an independent audit.
Keep the key to yourself.
See how it works