— Security

Don't trust us.
Verify us.

The local core needs no account and touches no server. Pro's sync is end-to-end encrypted, so even we can't read your workspaces. AI never trains on your data. And the limits — yours to manage, not ours to hide — are printed below.

0Accounts needed to work

E2EEncrypted Pro sync

0AI training on your data

0%Exportable, always

The model ↓ Sync & keys Attack surface Threat model Your checklist Report an issue

— The Model

Three layers.
Each one verifiable.

Layer 01 · Default

The local core

The full app — every widget, the infinite canvas, export — runs in your browser and stores everything in IndexedDB on your disk. No account, no server, no network calls after load.

Eliminated: credential breaches, provider snooping, mass data leaks, insider access. There is nothing central to attack.

Layer 02 · Opt-in

Encrypted sync — Pro

Turn on sync and your workspaces are encrypted on your device before they ever leave it. The relay stores ciphertext it cannot open. Keys are derived on your hardware, from your credentials, and never transmitted.

Eliminated: readable breach blast radius, provider-side reading, subpoena exposure. The trade-off — key recovery is yours — is below, in writing.

Layer 03 · Governed

The ecosystem

Collaboration grants scoped, revocable keys — never raw access. AI runs on-device by default and never trains on your workspaces. Marketplace widgets pass automated and human review before listing.

Governed by: explicit rules, published on this page — including the honest limits of same-origin widgets.

Guarantee 01The core app works offline with no account — forever, regardless of what you pay.

Guarantee 02Cancel Pro and your workspaces stay on your device, fully functional. No hostage files.

Guarantee 03Your workspace data is never used to train AI. Ever.

Guarantee 04JSON export is always free. Leaving Stactora is always possible — with everything.

— The Cloud Layer, Under the Hood

Every Pro feature,
with its security rules attached.

Sync

✓Zero-knowledge: keys derived on-device from your credentials; the relay stores opaque ciphertext.
✓Authenticated encryption on every blob; tampering fails validation, not silently corrupts.
✓Per-device keys — removing a device revokes only that device's access.
!Honest limit: the relay sees encrypted blob sizes and timestamps. Never contents.

Collaboration

✓Sharing = key granting. Invitees receive a scoped key to one workspace, not your account.
✓Revocation propagates — removed collaborators lose access on next sync cycle.
✓Roles (view / edit / manage) enforced at the key level, not just the UI.
!Honest limit: the relay sees connection metadata — who shares with whom, when. Never content.

AI

✓On-device first: local inference runs in your browser wherever the model allows.
✓Never training data. Your workspaces, prompts and generations are not stored or used for training.
✓Cloud calls, when needed, are stateless — processed, discarded, never logged with content.
!Honest limit: heavy generation may route to cloud models — the request content is ephemeral, the fact of the request is not.

Marketplace

✓Two-stage review: automated static checks, then human review, before any listing goes live.
✓Report & remove: one click flags a widget; confirmed issues pull the listing and notify installers.
✓Payments isolated: a PCI-compliant processor handles money; card data never touches Stactora. Creators keep 70%.
!Honest limit: review reduces risk, it can't eliminate it. Same-origin rules still apply — see below.

— How Zero-Knowledge Sync Works

The relay routes. It never reads.

key-flow.txt — what leaves your device, and in what form

── on your device ──────────────────────────────────────
workspace …→ derive key(your credentials)   // never transmitted
           → encrypt(workspace, key)        // authenticated, on-device

── in transit & at rest ─────────────────────────────────
relay receives:  [ ██ ciphertext blob ██ ]
relay can read:  nothing — no key ever arrives
relay stores:    ciphertext + minimal metadata (size, time)

── on your other device ─────────────────────────────────
blob → decrypt(key derived locally) → workspace restored

// consequence, stated plainly:
// lose your credentials + recovery phrase = lose synced history.
// that is what "even we can't read it" costs. we think it's worth it.

Key recovery, honestly: zero-knowledge means no password reset that can decrypt your history. When you activate Pro you'll receive a recovery phrase — store it offline, somewhere real. Lose both credentials and phrase, and the ciphertext on our relay stays ciphertext forever. We consider that feature, not a flaw. You should decide knowingly.

— Side by Side

The attack surface, compared.

Surface	Stactora Local	Stactora Pro	Typical cloud app
Credentials
Account requiredBarrier to doing work	None	Optional, modern auth	Mandatory
Password database#1 breached artifact on the web	Doesn't exist	One, per modern practice	Constant target
Your Data
Provider-side data at restWhat servers hold	Nothing	Ciphertext only	Readable plaintext
Breach blast radiusWorst case if systems fall	Zero	Unreadable blobs	Entire user base
Insider accessEmployees reading content	Impossible	Cannot decrypt	Policy-dependent
AI on your dataTraining & retention	On-device only	Never trains, never stored	Often unclear
Exposure
Third-party processorsWho else touches your bytes	Nobody	Payments only	Often several
TelemetryBehavioral breadcrumbs	None	Minimal, disclosed	Common practice
Legal seizureWhat a subpoena produces	Nothing of yours	Ciphertext, not content	Your data, on file
0bytes readable by us· 0AI training sets· 0%exportable, on every plan

Yes — automatic sync is more convenient than manual export.
We just route it through math instead of trust.

— The Threat Model

What this protects.
And what only you can.

Protected by design

eliminated by architecture, not policy

✕Mass provider breaches. Local users have nothing stored centrally. Pro users have ciphertext — a breach yields noise, not notebooks.
✕Provider-side snooping. We never receive readable workspaces — free or Pro. No employee, script, or subpoena can read what never arrives.
✕AI data harvesting. Your workspaces are never training data, and AI requests aren't retained. That's Guarantee 03 — permanent.
✕Silent deprecation. Your data is plain JSON you already possess. The app can't hold it hostage, and neither can we.
✕Marketplace drive-bys. Every listing passes automated static checks and human review before it can be installed by anyone.

Yours to manage

no software can cover these — honesty required

!A stolen, unlocked device. Local data is only as safe as your screen lock. Enable full-disk encryption — FileVault, BitLocker, LUKS.
!Your credentials & recovery phrase. Zero-knowledge cuts both ways: lose both, and synced history is unrecoverable — by anyone. Store the phrase offline.
!Backups. Nothing syncs automatically on the free plan. Export JSON regularly, or hardware failure is a data-loss event.
!Shared browser profiles. Anyone with your OS session can open the browser and read your workspace.
!Widget supply chain. Widgets run as same-origin code — install them with browser-extension caution. Details below.
!Malware & patches. No application defends a compromised OS. Keep the operating system and browser current.

On widget trust, honestly: widgets execute as same-origin code, and same-origin code can read storage within the app's origin. Storage namespacing is a convention, not a sandbox. Practical rule: treat installing a widget exactly like installing a browser extension — marketplace review helps, but for financial or deeply personal data, prefer built-in widgets unless you trust the author.

— Your Moves

The hardening checklist.

Twenty minutes, once. Covers everything the right-hand column asks of you.

Everyone — local core

Encrypt your diskFileVault, BitLocker, or LUKS. This is what protects the workspace if the device is lost or stolen.

Lock your screen, alwaysLocal-first security ends the moment someone else has an unlocked session. Make it reflex.

Export JSON monthlyThirty seconds. Keep a copy on an encrypted drive or USB stick. Free-plan backup is on you.

Use a dedicated browser profileIsolates the workspace from shared sessions, extensions, and nosy coworkers.

Pro members — cloud layer

Use a unique passwordYour account keys the E2E chain. A password manager generates and remembers it so you don't reuse one.

Store your recovery phrase offlinePaper or metal, somewhere real. It is the only key to your synced history if credentials are lost.

Review connected devicesYour profile lists every device holding sync keys. Remove the ones you no longer own.

Vet widgets before installingMarketplace review helps — but for sensitive data, built-in widgets or trusted authors only.

— Responsible Disclosure

Found a hole? Tell us first.

The app code, the account and sync chain, the E2E implementation, the widget API boundary and import/export parsing are all fair game. We acknowledge within a week and publish fixes with credit.

/.well-known/security.txt

# Stactora security policy
Contact:        mailto:security@stactora.com
Expires:        2027-06-01T00:00:00Z
Preferred-Languages: en
Policy:         https://stactora.com/security/#disclosure

# In scope:     the web application, accounts & auth, the sync relay
#               and its E2E implementation, collaboration permissions,
#               AI request handling, marketplace review & the widget
#               API boundary, import/export parsing.
# Out of scope: social engineering, automated scanner spam,
#               compromised end-user devices.

— The Hard Questions

Asked by people who don't do vibes-based security.

Do I need an account to use Stactora?

No. The complete local application — every core widget, the infinite canvas, offline use, export — works with no account, forever. Accounts exist only for the optional Pro layer: sync, collaboration, AI, and the marketplace.

You used to say "no accounts, ever." What changed?

The local promise didn't — and this page is the receipt. Accounts exist solely to route optional cloud features you choose to rent. No core feature was ever paywalled, export remains free, and cancelling Pro leaves your workspaces fully functional on your device. The four guarantees above are permanent; hold us to them publicly if they ever wobble.

Is Pro sync really end-to-end encrypted?

Yes — by design. Your encryption keys are derived on your devices from your credentials and never leave them. The sync relay stores only authenticated ciphertext it cannot decrypt. Verify it yourself: the network tab shows opaque blobs, never workspaces.

Can Stactora reset my password?

No — and that's the point of zero-knowledge. Without your recovery phrase, nobody including us can decrypt your synced history. When you activate Pro you'll receive a phrase; store it offline. Lose both credentials and phrase, and the ciphertext stays ciphertext. We'd rather say that plainly than offer a "secure" reset that quietly gives us your keys.

Is IndexedDB encrypted on my device?

Not by Stactora, and we won't pretend otherwise. Treat it like any local file: full-disk encryption is the correct protection at rest. Checklist move 01 covers it.

Can a marketplace widget read my other widgets' data?

Same-origin code could, technically — widget isolation is a convention, not a hard sandbox, and we say so rather than imply otherwise. Marketplace listings pass automated checks and human review, can be reported and pulled, and signed manifests are on the roadmap. Until sandboxing ships: install widgets with browser-extension caution, and keep financial or deeply personal data in built-in widgets.

Has Stactora ever had a data breach?

The local core has no central store to breach — that incident class can't occur by construction. Pro's relay holds ciphertext, so even a relay compromise wouldn't expose readable workspaces. What can go wrong is a flaw in our code; if one is found, it's disclosed on this page under the policy above, with credit to the reporter.

How does Stactora handle GDPR?

On the free local plan, no personal data ever reaches us — there is nothing for us to access, port, or erase. Pro members have an account: an email and encrypted blobs. Deletion removes both, JSON export satisfies portability, and a data-processing addendum is available on request.

The audit takes
ninety seconds.

Open the app. Open devtools. Watch the network tab — with sync off you'll see nothing leave; with Pro sync on you'll see opaque blobs. That's the whole trick, and you just checked it.

Start Free See Pro

Local core always free·E2E sync by choice·Export anytime·Verify, don't trust

Don't trust us.Verify us.

Three layers.Each one verifiable.