Engineered So That Even We Cannot Peek Inside Your Vault.
When protecting root server keys, Cloudflare DNS, and payment gateways, trust is a liability. That is why TeamDeed is engineered with zero-knowledge, mathematically verifiable cryptography.
Ensures confidentiality and integrity; ciphertext cannot be altered or bit-flipped without failing tag verification.
Derives exact 256-bit entropy keys directly in browser memory without sending master keys to server.
Randomly generated per item via window.crypto.getRandomValues(); IV is never reused.
Appended to payload buffer and validated upon decryption to prevent replay attacks.
vault_items contains strictly encrypted_payload, payload_iv, payload_tag, encrypted_symmetric_key, and nominee_encrypted_key. There is no column for plaintext credentials anywhere in the schema.The 4 Defense Layers of TeamDeed
Client-Side Envelope Encryption (AES-256-GCM)
Every secret payload is encrypted locally inside the user's web browser using a freshly generated 256-bit Data Encryption Key (DEK). The cipher uses Galois/Counter Mode (GCM) with a 96-bit unique IV and 128-bit authentication tag to prevent ciphertext tampering.
Dual Escrow Key Encapsulation
The DEK itself is encrypted twice: once under the Primary Owner's master key, and once under the designated Nominee Partner's public key (nominee_encrypted_key). Plaintext DEKs exist only in browser memory and are wiped immediately upon encryption.
Native Browser Web Crypto API (Zero External JS Leaks)
Decryption operates exclusively via window.crypto.subtle in modern browsers. No third-party tracking scripts, analytics, or untrusted CDNs are loaded in the Nominee Decryption Portal, preventing memory-scraping attacks.
Immutable SHA-256 Notary & Forensic Audit Trail
Every deed e-signature, pulse check-in ping, and grace period cancellation produces an immutable cryptographic seal stamped with exact UTC timestamp, signer IP address, and browser fingerprint compliant with ESIGN and UETA.
Responsible Vulnerability Disclosure & Bug Bounty
If you believe you have discovered a security or cryptographic vulnerability in TeamDeed, please notify our security operations team at security@teamdeed.com. We provide rewards of up to $10,000 for qualifying zero-knowledge boundary vulnerabilities.