Security Whitepaper

Zero-knowledge, end-to-end encrypted, and built from standard, audited cryptography.

Version 1.0 (draft) · 4 July 2026 · Oscou — Our Safe Corner of the Universe

Who this is for

This is for the security-minded reader: someone deciding whether to trust Oscou with their most sensitive data, a security professional evaluating us, or anyone who simply wants to know exactly how their information is protected. We've tried to keep it plain without being vague. Where something is a limitation, we say so.

The short version

• Everything is encrypted on your device, before it reaches us. We store only scrambled data. We can't read your passwords, files, or notes — and we can't be compelled to hand over something we don't have.
• We don't invent our own cryptography. Oscou is built from standard, well-studied algorithms — AES-256, Argon2id, HPKE, X25519, Ed25519 — assembled conservatively. The novel part is the product, not the maths.
• Your master password never leaves your device. Not when you sign up, not when you sign in. We never see it, and we never store anything that would let us — or an attacker who steals our database — guess it.
• Sharing is end-to-end encrypted. When you share, only the people you choose can decrypt what you shared. Our servers pass along sealed data they cannot open.
• Even if we were fully breached, there is nothing in our database we could read. Your vault is protected by keys derived from your master password alone, which we never see. Because your password is the only secret, we require a strong one at signup — and Argon2id makes guessing it ruinously slow.
• One implementation, open to scrutiny. All of this lives in a single cryptographic core, reused across every app. That means one thing to audit, not five.

1. What we protect against — and what we don't

Being honest about the threat model is the most important part of a security whitepaper. Here's ours.

We protect your data against:

• A compromise of Oscou's servers, databases, or backups.
• Oscou staff — no one here can read your vault.
• Legal or coercive demands for your plaintext (we don't have it to give).
• Attackers on the network between you and us.

We rely on (trust):

• Your device at the moment you unlock your vault, and your operating system's random-number generator.
• Our cryptographic core and the apps that embed it — which is why we publish this design, get it audited, sign our releases, and run a bug bounty.

What encryption alone cannot solve — stated plainly:

• A compromised device. If malware or a malicious browser extension is running on your unlocked device, it can see what you see. No password manager can fix that with cryptography; we mitigate it with signed, reviewed, reproducible builds.
• Reading isn't forgetting. Anyone you share a secret with can copy it while they have access. Encryption controls who can decrypt — it can't un-see what a person already saw. Removing access protects future changes, not the past (see §7).
• Some metadata is visible to us. We can't read your data, but we do see certain operational information. We list exactly what in §10, rather than pretend otherwise.

2. The building blocks

Oscou uses only established, widely-reviewed cryptographic primitives:

Every encrypted record is tagged with a version, so we can strengthen parameters or adopt new algorithms over time without stranding your data.

3. How your master password becomes your keys

Your master password is the one secret only you know. Here's how Oscou turns it into the keys that protect your vault — all on your device:

• Your master password is fed through Argon2id, a deliberately slow, memory-hungry function (baseline: 64 MiB of memory, 3 passes). This makes guessing passwords enormously expensive for an attacker.
• This produces your Master Unlock Key — derived from your master password alone, which never leaves your device and is never stored anywhere.
• That key unwraps your Account Key — the root key for your vault — which in turn unwraps the individual keys that protect each item and file.

This layering has a practical benefit: changing your master password is fast. We only re-wrap one root key, not re-encrypt your entire vault.

If you lose your master password, no one — including us — can recover your data. That is the direct, unavoidable cost of true zero-knowledge encryption. §9 explains the safety nets we give you so this doesn't happen by accident.

4. Why your master password is enough

Oscou has no second secret — no separate key to store, no recovery file to keep. Your master password is the single secret that protects your vault. That keeps the product simple to use, and it means the only thing you need to unlock Oscou on a new device is something you already carry: your password. But it puts real weight on two safeguards working together.

Argon2id makes guessing slow and expensive. Your password isn't used directly; it is run through Argon2id (baseline: 64 MiB of memory, 3 passes), a deliberately memory-hard function. Even with specialised hardware, an attacker can only test passwords very slowly. A strong password behind Argon2id is not realistically crackable.

We require a strong master password when you sign up. Because your password is the only secret, we don't let you pick a weak one. A strength meter enforces this at signup and blocks passwords that are too easy to guess.

The honest trade-off. Without a second secret mixed in, if an attacker stole our entire database, the only thing standing between them and a given vault would be that account's master password run through Argon2id. A strong password makes such an offline attack hopelessly expensive; a weak one would not. That is precisely why we stop you from choosing a weak master password in the first place — the strong-password requirement is not a nicety, it's the safeguard.

5. Signing in without revealing your password

When you sign in, Oscou proves you know your master password without ever sending it to us. We use an augmented password-authenticated key exchange (SRP-6a), the same proven family of protocol used by other reputable password managers. Our server stores a verifier that lets it confirm you know your password but cannot be used to work out what your password is — even by us, even offline. (Our design is built to move to the newer OPAQUE protocol in future without any change to how your vault is encrypted.)

Two separate things happen at sign-in, and it's worth keeping them distinct:

• Authentication unlocks your session (proves who you are to our server).
• Decryption unlocks your vault, using keys derived entirely on your device.

The key that decrypts your vault is never transmitted. Your login and your encryption are independent. You can add two-factor authentication — an authenticator app (TOTP), a passkey/security key (WebAuthn), or email — for an extra check at sign-in.

6. How your vault is encrypted

Every item — a login, a secure note, a card, a 2FA seed, a stored passkey — is encrypted on your device with its own key using AES-256-GCM, which protects both the confidentiality and the integrity of the data (tampering is detected).

We encrypt everything, including item names and website addresses. Many products leave these unencrypted so their servers can search and sort your vault. We don't. The trade-off we chose in your favour: search and autofill matching happen on your device, on the already-decrypted vault. Our servers never see, index, or sort your titles and URLs.

Files you store are encrypted the same way, split into chunks that are each sealed and bound in order so nothing can be silently truncated or rearranged. We store only the encrypted blobs.

7. Sharing, end to end

Sharing is where most of the risk in a password manager lives, so here's exactly how Oscou does it.

• A shared folder (a Collection) has its own random key. The items inside it are protected by that key.
• When you share the Collection with someone, your device fetches their public key and uses HPKE to seal the Collection's key so that only their private key can open it. This sealed key is stored on our servers, which cannot open it.
• The recipient's device opens the sealed key locally and can then decrypt the shared items. At no point does our server hold a key that can read the contents.

"The sharer pays, receivers are always free" is a billing rule — not a security compromise. Whether or not someone is on a paid plan changes nothing about the encryption. Receiving shared items only requires a (free) account with a public key. The money question and the cryptography sit side by side and never mix.

Permissions (view-only, edit, allow-resharing) are enforced by our servers on top of the encryption. Encryption decides who can decrypt; the server decides who can change what.

When you remove someone's access, Oscou rotates the Collection's key and re-seals it to everyone who remains — so the removed person's device can't use an old cached key going forward. We'll also remind you, honestly, that anything they already saw should be considered known: for a truly sensitive credential, change the password itself.

8. Passkeys and two-factor codes

• Passkeys. Oscou can store and fill passkeys (WebAuthn credentials) for the websites you use. Their private key material is encrypted exactly like any other vault item, and only decrypted on your device when you sign in somewhere.
• Authenticator (2FA) codes. Oscou includes a built-in authenticator. The seeds are stored as encrypted fields; the codes are generated on your device.
• Passkeys and security keys can also protect your Oscou account itself as a strong second factor.

9. Losing access, and planning ahead

True zero-knowledge means we cannot simply reset your password and give your data back. Instead we give you safety nets you control:

• Emergency Access is your safety net. You can nominate a trusted person who may request access to your vault. Access is only released after a waiting period you set, during which you can decline. The mechanism is fully end-to-end encrypted — your keys are sealed to your trusted contact's key, and our servers only release the sealed data after the delay, never the keys themselves.
• For organisations (a later release), administrators will be able to recover an employee's account under policy, using keys held by the organisation.

We will always be direct about this: the price of data only you can read is that only you can recover it. Our job is to make sure you're never one forgotten password away from disaster.

10. What our servers can and cannot see

We don't hide this. Reducing operational metadata further — for example, obscuring the sharing graph — is something we intend to keep improving, and we won't claim protections we haven't built.

11. How to hold us to this

A security promise is only worth as much as your ability to check it. Our commitments:

• Independent audit. Our cryptographic core will be audited by a reputable, independent security firm, and the report will be published.
• This whitepaper stays public and versioned, so you can see what changed and when.
• Bug bounty. We will run a public bug-bounty program and disclose responsibly.
• One core to review. Because all our apps share a single cryptographic implementation, the thing that protects you is a single, focused codebase — not a different one on every platform.

Found something? Please tell us at security@oscou.com. We welcome scrutiny — it's how a security product earns trust.

Glossary

• Zero-knowledge: a design where the service provider has no ability to access the plaintext of your data.
• End-to-end encrypted (E2EE): only the sender and intended recipients can read the content; intermediaries (including us) cannot.
• AEAD (e.g. AES-256-GCM): encryption that also detects tampering.
• KDF (e.g. Argon2id): a function that turns a password into a strong key, made deliberately slow to resist guessing.
• HPKE / public-key sealing: encrypting a piece of data so that only the holder of a specific private key can open it — how we hand a shared key to exactly one person.

This document describes Oscou's design and will be updated as the product is built, audited, and released. It is not a contract or a guarantee of fitness for a particular purpose.