Security model

Keys

When you create an account, your browser generates three OpenPGP key pairs (Curve25519). Each has one job, so that a problem with one key does not expose everything.

Master key         root of your keys; never encrypts content
├── Mail key       one per address; encrypts mail; public key published via WKD
└── Content key    wraps the AES-256-GCM keys for files, documents, contacts and calendars
    └── Drive      one key per file and folder; a folder's key wraps its children's keys

Master key: Its private key is encrypted with a key derived from your password (Argon2id) and stored in our key management service. The Mail and Content private keys are encrypted to the Master key.
Mail key: Used only for mail. The public key is published through Web Key Directory, so PGP users anywhere can find it, and given to our mail server so it can encrypt incoming mail.
Content key: Never published. It wraps the symmetric keys that encrypt your other content. In Drive, every file and folder has its own key, and documents and spreadsheets are encrypted with the key of their file.

Signing in

Faral uses the Secure Remote Password protocol (SRP-6a, RFC 5054). Your password is run through Argon2id (3 passes, 64 MB, 1 lane) in your browser. The server stores only an SRP verifier, from which the password can’t be derived. When you sign in, your browser and the server prove to each other that each holds its half, without the password or a hash of it being sent.

After sign-in, the server returns your encrypted Master key, and your browser decrypts it locally. The server never sees the password, a password hash, or your private keys.

You can add a second factor: an authenticator app (TOTP) or a passkey. Access tokens last 30 minutes and refresh tokens 24 hours. The key management service checks that your session still exists on every request, so signing out ends it immediately.

What is encrypted, and what is not

We encrypt content. Some metadata stays readable because the service needs it: to deliver mail, to schedule meetings, to list and sort your files.

Data	Encrypted	Readable by our servers	How
Mail	Body, attachments	Sender, recipients, subject, dates	OpenPGP (PGP/MIME) with the Mail key
Files	Contents	Name, size, type, folder structure, sharing	AES-256-GCM, a key per file
Documents and sheets	Content, versions, images	Title, dates	AES-256-GCM with the file’s key
Calendar	Description, location	Title, times, recurrence, attendees	OpenPGP, encrypted to every attendee
Contacts	Phone numbers, addresses, notes, company, job title	Name, email address	AES-256-GCM with the Content key
Chat	Messages	Members, times	AES-256-GCM, a key per conversation
Calls	Audio and video	Participants, times	LiveKit end-to-end encryption, key from the conversation
Account	Private keys	Name, email address, organization, groups, roles, public keys	—

Exceptions

Mail from outside Faral. When someone emails you without PGP, the message arrives in plaintext. Our mail server encrypts it with your Mail key before storing it, so it briefly handles the plaintext. Every encrypted mail service has this limit.
Mail to people without PGP. You can send a normal email, which is not end-to-end encrypted, or a password-protected message. The key for a password-protected message is derived from the passphrase alone, so its protection depends on the passphrase: someone with access to our storage could try to guess it.
Calendar events with outside attendees. If an attendee has no key Faral can find, the event is stored without encryption so that they can read the invitation.
Amal. When you ask the assistant something, the mail and events it works with are decrypted in your browser and sent to Mistral AI for processing. Nothing is sent unless you ask. AI can be turned off: by administrators for an organization, or by you for a personal account.

Sharing

With colleagues

To share a file or folder with someone in your organization, your browser encrypts its key to their Content key and signs it. Their browser checks the signature before using the key, so the server can’t substitute a key of its own. When you stop sharing a folder or document, it gets a new key.

With anyone, through a link

A Drive link contains a 32-byte secret after the #. Browsers don’t send that part of a URL to servers, so we never receive it. You can add a passphrase, an expiry date of up to a year, and a download limit. Wrong passphrases make the recipient wait longer before the next try.

Organizations

An organization has its own key pair, generated in an administrator’s browser. Its private key is encrypted to each administrator and is never stored readable.

When you join an organization, a copy of your Master key is encrypted to the organization’s key. This lets your administrators restore access to your account, and Settings tells you that it applies. Faral cannot open this copy. The administrator recovery flow that uses it is not built yet.

Shared mailboxes and calendars have their own versioned keys, encrypted to each member. Mail arriving at a shared mailbox is encrypted to its current key. When a member is removed, the mailbox gets a new key version: they can no longer read new mail, but existing mail is not re-encrypted. When an administrator leaves, the organization’s key is replaced.

Recovery

When you create an account, you get a 24-word recovery phrase. It is shown once and never sent to us. A copy of your Master key is encrypted with a key derived from the phrase.

The flow that uses this phrase to restore an account is not built yet, and neither is recovery by an organization’s administrators. Until they are, a forgotten password means your encrypted data can’t be recovered. Faral has no way to reset your password and keep your data, by design.

Keys in your browser

To avoid fetching keys on every action, your browser keeps them in IndexedDB. Symmetric keys are stored as non-extractable WebCrypto keys, and private keys are stored encrypted under a non-extractable key. Signing out removes them.

This protects keys on disk. It does not protect against code running in the page: an attacker who can run script in Faral can use the keys while you are signed in. That is true of every web application that encrypts in the browser. Mail is the most likely way in, so incoming messages are sanitized and shown in an isolated frame with its own Content Security Policy, and remote images are blocked unless you allow them.

Key management service

Encrypted keys and SRP verifiers are held by a separate service with its own database and credentials. The main application server can’t read that database. The key service stores only encrypted key material and can’t decrypt it.

Infrastructure and third parties

Faral runs on servers rented from Netcup in Amsterdam. Mail, files, databases, backups, calls and our source code are hosted there. These outside services are involved:

Service	Used for	What it receives
Netcup (Germany)	Servers and storage	Everything we store, encrypted as described above
TransIP (Netherlands)	DNS	Our domain records
Let’s Encrypt (United States)	TLS certificates	Our domain names, no user data
keys.openpgp.org	Finding PGP keys of people outside Faral	The address you are writing to, if its key isn’t found another way
Mistral AI (France)	The Amal assistant	The text Amal works with, only when you ask it something

What Faral protects against

A breach of our servers. Stolen databases and files contain encrypted content, encrypted keys and SRP verifiers.
Our own staff. We can’t read encrypted content, even with full database access.
Interception. Traffic uses TLS, and the content inside it is already encrypted.
Password guessing. Argon2id makes each guess slow, and the server limits attempts.

What it does not

Code you are served. Malware on your computer, script injected into Faral, or an attacker who controls our servers and changes the code they send can use your keys while you are signed in.
Metadata. Addresses, subjects, file names, titles and times are readable by our servers.
A lost password. Until recovery is built, encrypted data is lost with it.
Your organization. If you belong to one, its administrators will be able to recover your account and read what you can.

Standards

Every cryptographic choice maps to a published standard.

Purpose	Algorithm	Standard
Key pairs	Curve25519	OpenPGP
Content encryption	AES-256-GCM	NIST SP 800-38D
Password hashing	Argon2id	RFC 9106
Sign-in	SRP-6a	RFC 5054
Session tokens	Ed25519	RFC 8032
Mail encryption	PGP/MIME	RFC 3156
Password-protected mail	PBKDF2-SHA256, 600,000 iterations	RFC 8018
Key discovery	Web Key Directory	IETF draft

Verifying this

Faral’s source code is not public yet, and no independent audit has been done. Until then, this page is our description, not something you can check. We will publish the code on git.faral.io.