Encryption

Your documents, sessions and code are readable only by the people and agents in them. Everything is encrypted end to end on your devices, so the relay that carries it, the pool that runs your sessions and whoever operates either of them see only ciphertext. Knowing a document's id gets you nothing.

How it works

Mod's sync is built on Subduction and Keyhive, from Ink & Switch. Subduction moves changes between peers; Keyhive decides who belongs and holds the keys. Membership is a set of signed grants that every peer can check for itself. A server introduces people, but it never decides what they can do and it never holds a key that opens your work.

Keys. Every device makes its own key on first run and keeps it in its keychain (on a Mac) or the browser's storage (in the window). A person is a group of their devices, so a grant to you reaches every device you have, including ones you add later. When you add a device, an existing one delegates to it. To make sure losing every device does not lose you, your first device also adds a passkey, which Apple or Google syncs with your account.

Groups. A project is a group, and so is a session. Every document and app in a project grants to the project's group, so adding someone is one grant, not one per document. A session can be shared on its own: its thread, the documents its agent wrote and the code on its VM grant to the session's group, and nothing else in the project does. A single document can be shared too, without reaching its siblings.

Encryption follows membership. Each group has a key that only its members' devices can derive, and every change is encrypted to it before it leaves your device. The relay stores and forwards ciphertext, and serves a peer only what that peer's grants allow. Because every peer checks every change against the grants, a write from someone without the right is refused everywhere, not just hidden by a button.

Agents. An agent has a key of its own, granted by its person or its session, and reaches only what that grant covers, never more than its person. A session's key is held by the host that runs it, your Mac, your server or a pool host, and never inside the VM. A pool host can reach the session it is running and nothing else of yours.

Removing someone. When you remove a member, their grant is revoked and the group's key rotates. Every peer refuses new changes signed by their keys, including peers that were offline when it happened, and nothing written after the removal can be read with their keys. What they had already seen stays on the devices that had it, as with any shared document, and the remove dialog says so.

Using it as you build

You never handle a key. Sharing is the interface: share a project as editor or viewer, share one session, or share one document, and the grants and keys follow. An invite is a one-time key your device seals and the server holds until the right person signs in; the server can delay an invite but cannot create, widen or keep one alive after you revoke it.

What you build on Mod is encrypted the same way without any code of its own. An app's records are documents in a project, so they go to the project's members and no one else. A package tool or connector runs with the access of the session that calls it.

Every person and agent who can reach something is listed with it, with the reason, so nothing reaches your work silently.

Limits

• Removing someone stops them reading anything new. It cannot take back what their devices already received.
• Recovering a person who has lost every device depends on the passkey their first device added.