Privacy

The browser seals personal columns with libsodium X25519 sealed boxes before upload. The server stores ciphertext.

What is sealed

Customer names, email addresses, and transaction or line-item descriptions are personal columns. The browser seals each value on its own before that value is uploaded.

The seal is a libsodium sealed box, crypto_box_seal. That is X25519, then XSalsa20-Poly1305. The recipient is the workspace public key. The server does not receive the plaintext of those columns.

What the server stores

The server stores the sealed box as ciphertext. It stores the workspace public key so a browser can seal to it. It does not store the passphrase, the recovery kit, or the unwrapped private key, and it cannot open a sealed box.

Amounts, dates, plans, status, and country stay readable, on pseudonymous ids, so subscription metrics can be calculated.

Keys

Each workspace has one X25519 keypair. Members do not get their own encryption keypair. A member's copy of the workspace private key is wrapped in the browser with that member's passphrase, using Argon2id (crypto_pwhash) and crypto_secretbox_easy. The server never receives the passphrase.

A recovery kit is required. It is not stored on the server. If the private key and the recovery kit are both lost, the sealed columns cannot be restored.

This website

The product is at app.openkaiser.io. This marketing site does not add an analytics script to the app.

When this site is built with both PLAUSIBLE_DOMAIN and PLAUSIBLE_SRC set, the only analytics script is self-hosted Plausible Community Edition. PLAUSIBLE_DOMAIN is the site name sent to that host. PLAUSIBLE_SRC is the script URL on that host. The script is not loaded from Plausible Cloud, Google Analytics, or any other third party. Plausible Community Edition's script does not use cookies.

If those two values are unset, this site loads no analytics script. Fonts are files this site hosts. The page does not request a font from Google.