Security

How we protect your data

Actarium is end-to-end encrypted: everything you enter is encrypted in your browser before it reaches our server. The server only stores ciphertext – and has no key for it.

1. The link is the key

When you create a list, your browser generates a random secret (256 bits). It sits in the link after the # sign. Browsers never send this part of an address to servers – it does not appear in any server log.

From this one secret, the browser derives everything else with HKDF-SHA-256. The identifier and hash help the server deliver the right data and check write permissions – it cannot read anything with them.

What our server sees

  • a random identifier per list
  • hashes of the access tokens
  • when something changed and how many records there are
  • the size of the records (padded to fixed blocks)

What it does not see

  • titles, notes and decisions
  • names of owners
  • due dates and status
  • names of lists and meetings
  • the key itself

2. Three kinds of links – roles without accounts

🔑Team linkread, write, empty the inbox, create links – for everyone who collaborates
👁Read-only linkread only – for stakeholders or the projector; does not reveal the team link
📮Inbox addressdrop only – for sister tools like Votarium; cannot read anything

The weaker links are derived from the team link. They do not reveal it – a read-only link can never write.

3. The inbox

Sister tools like Votarium should be able to write action items from a meeting into your list – without being allowed to read. For this, every list has a key pair: any tool can seal a letter with the public key, but only a device with the team link can open it. Even a hacked sister tool could at most drop letters.

4. Honest limits

Whoever has the link has access. If the team link ends up in a large chat, everyone in it can change the list. Share read-only links where reading is enough.
Link gone = data gone. We cannot recover a key. Store the link safely and download an encrypted backup now and then.
You trust the program code. As with any encryption in the browser, the code comes from our server. A compromised server could deliver compromised code. We use strict security rules (CSP), load no third-party scripts and publish the source code.
Metadata remains visible. The server sees when and how often a list is used – but not what is in it.

Technology in brief

  • AES-256-GCM – encryption of every record, bound to list, type and identifier
  • HKDF-SHA-256 – derivation of all keys from the secret in the link
  • ECDH P-256 – sealed letters for the inbox (modelled on HPKE)
  • PBKDF2-SHA-256, 600 000 Runden – password protection for backup files
  • Web Crypto API – the browser's built-in cryptography, no third-party library

Same calculation on every device: changes are encrypted individually and merged in the browser (“last change wins” per field). Gaps or a rolled-back state are detected.

Create list → Privacy policy