Built so you don't have to trust us

Every secret is encrypted in your browser or CLI before it leaves you, with keys derived from your passphrase and a device-held Secret Key (2SKD). The cipher is XChaCha20-Poly1305; the key exchange is X-Wing, a post-quantum hybrid. A server breach, a rogue operator, or a subpoena yields ciphertext and nothing else.

A team namespace has one content key. Each secret is sealed to it, and the key is wrapped to every member's X-Wing public key (envelope encryption). Members decrypt on their own devices; the server only routes ciphertext. Adding a member wraps the key to their key; removing one rotates it and re-wraps to the rest. (Team encryption is rolling out in phases.)

Envelope encryption is only as trustworthy as the public keys, so Pock does two things. First, your client pins each member's key on first sight (like SSH known_hosts) and alarms loudly if it ever changes. Second, every public key is appended to a public, append-only Merkle log: the server publishes signed tree heads, and clients verify inclusion and append-only consistency proofs. Because anyone can mirror the tree heads, a server that swaps a key leaves permanent public evidence. You can audit it yourself:

A web app's own origin serves its code, so nothing stops that origin from shipping a targeted backdoor - TLS and CSP don't defend against the server itself. Pock can't prevent that, but it makes it impossible to do quietly. Every release publishes a signed manifest of the SHA-384 of every shipped asset, appended to the same append-only Merkle log. A verifier fetches the served files, re-hashes them, and checks they match a manifest that's provably in the public log - so a tampered or per-user payload either fails verification or leaves permanent public evidence. Audit it yourself:

The CLI and desktop app are the high-assurance tier - versioned, installed builds that can also verify the web surface before you trust it. The web vault is tamper-evident and independently verifiable; the native clients are belt-and-suspenders.

• ›Metadata isn't encrypted. Namespace, item, and environment names are stored in plaintext so the server can route them - it sees that acme.web.prod.STRIPE_KEY exists, never what it equals.
• ›Web code is served by our origin. We can't prevent a compromised origin from serving bad code - but every release is logged so tampering is detectable, and the CLI + desktop app are the high-assurance tier.
• ›TOTP seeds live on the server - but they're an access gate, not a decryption key. Confidentiality always rests on your passphrase.