Security and privacy

Personal Cloud is built so that Subcloak’s server stores your data without being able to read it, and so that your Macs don’t have to take the server’s word for anything. This page explains how: who holds which keys, what the server sees, and how adding, removing and recovering computers protect you. It ends with the limits, the things the design doesn’t protect against.

The short version

• Your computers lock everything before it leaves them. Rules, mocks, workspaces and share links are encrypted on your Mac. The keys exist only on your computers and on your Recovery Kit.
• The server is a store of locked boxes. It keeps them, passes them between your computers and handles sign-in and billing. It can’t open them.
• Your Macs check the server. Everything is signed by the computer that wrote it, and the list of your computers is a signed, chained record. A Mac refuses data, keys or computers that your own computers or your Recovery Kit didn’t sign.
• The worst a broken or hostile server can do is refuse service or hold data back. Your Macs notice when it does, stop, and tell you.

Who’s involved

Party	Role	Trusted with your data?
Your computers	The Cloak Proxy app on each Mac. Makes and holds the keys, encrypts, decrypts and checks.	Yes. Each computer you approve can read everything you sync.
Subcloak’s server	Stores encrypted data, relays it between your computers, handles sign-in and billing. Runs on Cloudflare.	No. Designed as if it could be hacked or turned against you.
Polar	Takes payments as our merchant of record.	Only with billing: your email and payment details, never your Cloud data.
Your email provider	Receives sign-in codes and account emails (a welcome message, and a deletion notice with its cancel link).	Only with those emails, which can’t read your data on their own.
People you send links to	Open share links in a browser.	Only with what you put in the link.

The keys

Instead of one key there’s a small ladder of them. The layering lets you add or remove a computer without re-encrypting everything you’ve ever synced.

Key	What it’s for	Made from
Each computer’s keys	Every computer makes a signing key (“this came from my MacBook Air”) and a sealing key (a letterbox only it can open) when it signs in. They’re stored in the Mac’s login Keychain and never leave it.	Ed25519 and X25519 key pairs
The account key	One key shared by all your computers. The server holds a copy for each computer, sealed to that computer’s sealing key, plus one sealed to your Recovery Kit. It can pass the sealed copies along but can’t open them.	256 random bits. Sealed with HPKE (RFC 9180: DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-256-GCM)
Collection keys	One per synced type: your rules, your mock sets, each workspace. Encrypted with a key derived from the account key.	256 random bits, AES-256-GCM, HKDF-SHA256
Item keys	Every saved version of every item gets a fresh key, encrypted with its collection key. The item is also signed by the computer that wrote it.	256 random bits, AES-256-GCM, Ed25519
The recovery key	A spare way in, on the Recovery Kit you keep. Its own sealing and signing keys are derived from it. It never goes to the server.	256 random bits, HKDF-SHA256 to X25519 and Ed25519
A share link’s key	One per link, in the link itself after #. Each piece of the share has a key derived from it.	256 random bits, HKDF-SHA256, AES-256-GCM. With a password: PBKDF2-HMAC-SHA256, 600,000 iterations

Every encryption uses AES-256-GCM with a fresh random nonce, and each encrypted piece is bound to where it belongs (its account, collection, item and writer), so the server can’t move a valid piece somewhere else. Hashes are SHA-256. Content is padded before encryption, so the server sees rounded sizes rather than exact ones.

Whenever a computer is removed, a Recovery Kit is replaced or the kit is used, your Mac makes a new account key and seals it only to the computers that should have it. Older keys stay on your computers to read older data, and nothing new is written with them.

These are standard algorithms from standard libraries: on the Mac, Apple’s Swift Crypto (CryptoKit underneath) and CommonCrypto for PBKDF2; in the recipient’s browser, the built-in WebCrypto.

What Subcloak can and can’t see

This is the same list as What Subcloak Can See in Settings › Cloud.

Subcloak can see	Subcloak can’t see
Your account email, account ID, plan and its status, and billing IDs	Rules, mocks, scripts, scopes, queries, workspaces, requests, environments, variables and comments, or the names of any of them
Device IDs, platform, app version, when each was last seen, and how many. Device names are encrypted	Share-link contents, titles and passwords
Opaque collection and item IDs, encrypted (padded) sizes, write times and which device wrote each item	Your Recovery Kit and your encryption keys
Share links: when made and when they expire, size, view count and country per view	The root certificate’s private key, Keychain tokens, .env files and AI keys: these never upload
The approximate country of a sign-in request, shown back to you when you approve it

Sizes and timing still show when you’re active. Your email lets you sign in, which shows how many computers you have and your plan.

One more detail: while a new computer asks to join, its name travels unencrypted so your other Mac can show it. The server deletes it when the request ends; from then on the name is stored encrypted.

How your Macs check the server

The server could, in principle, lie: hand a Mac the wrong data, hide changes, or slip in a computer or a key of its own. Your Macs are built to catch that.

• Every change is signed. Each synced item carries the signature of the computer that wrote it. A Mac refuses items from computers that aren’t on your account, and items a removed computer wrote after its removal.
• The change log is a chain. Every change gets the next number in a log, and each entry includes a hash of the one before. A Mac checks the chain as it reads, so changes can’t be dropped or reordered without it noticing.
• The list of computers is a signed chain too. Adding a computer, removing one, changing the account key and replacing the Recovery Kit are each signed by one of your computers or by the recovery key, and chained like the log. Your first computer remembers where the list started, and every Mac remembers how far it has checked, so the list can’t be swapped or rolled back.
• Every account key is committed to. The list records a fingerprint of each account key. A Mac only uses an account key whose fingerprint matches, so the server can’t hand it a key it made up.
• Your Macs compare notes. Each Mac regularly posts a signed checkpoint: how far it has read the log and the list of computers. The others check it against what they’ve seen. If the server shows two Macs different histories, the checkpoints disagree and sync stops with an integrity warning.
• Requests are signed. Every request the app sends is signed with that computer’s key, bound to the server’s address and the time. A stolen session alone isn’t enough to act as one of your computers. The server’s own signed statements, such as your plan, are checked against public keys built into the app.

Adding a computer

Approving a computer is the moment a dishonest server would most like to cheat: if it got its own computer approved, it would get your account key. The defense is a code you compare with your own eyes.

1. Each Mac picks a random number and commits to it (sends a hash of it) before it sees the other’s.
2. Both Macs work out a 6-digit code from both computers’ keys and both random numbers. If anything swapped in a different computer, the codes on the two screens differ.
3. The new Mac takes the account key only after you’ve clicked Codes Match on it, and only if the key matches the fingerprint in your list of computers. The Mac you already use signs the new computer onto the list only after you’ve clicked Codes Match: Approve.

The Mac you already use answers a request only when you click Compare Codes, and only a few within a short time, so the server can’t keep trying until a code happens to match. See Add another Mac.

Changes that wait for you

Encryption stops the server reading your data. It doesn’t stop a computer on your account, for example a stolen one, from changing it. So:

• Synced changes that can act on your Mac arrive switched off. Scripts, Map Local, Map Remote, DNS Spoofing, Rewrite, mock sets, failure scenarios and the external proxy wait for you to switch them on. Debugging tools’ master switches never sync.
• Your secrets only go where you used them. If a request’s destination changed on another computer, this Mac doesn’t attach its credentials, secret values or local files, and a changed request is sent without your variables until you approve it.
• Changed code doesn’t run. Scripts and MCP commands that changed on another computer stay off until you trust the workspace again.
• File paths and “skip certificate checks” switches never sync. A change elsewhere can’t point your Mac at its own files or lower its TLS checks.
• Changes to your computers are confirmed. When another computer adds or removes a computer, changes the account key or replaces your Recovery Kit, your Macs confirm it with each other. When none of them can, your Mac stops uploading and asks you: “Did you do this?”. No is the default.

See Review changes from another Mac.

Removing a computer

When you remove a computer, your Mac signs the removal onto your list of computers, recording how far through the change log it had checked. Anything the removed computer writes after that point is ignored by every Mac, and the server stops accepting its changes. In the same step, your Mac makes a new account key and seals it only to the computers you still have and to your Recovery Kit. The removed computer’s old key opens nothing new.

Computers that the removed computer approved are removed with it unless you keep them, so a thief can’t leave a computer of their own behind.

A removed computer keeps whatever it synced before, and removal can’t change that. See Remove a lost or stolen Mac.

The Recovery Kit

The Recovery Kit is the only copy of your keys that isn’t on one of your computers. The server keeps a copy of the account key sealed to it, which only the kit can open.

• Using the kit proves you hold it, signs every other computer off your account and gives the Mac you’re on a new account key that only it and the kit can open, in one step. A stolen computer can’t ride along. You approve your other computers again afterwards.
• Making a new kit needs the current one, so a computer on your account can’t quietly replace your kit with one someone else holds. The old kit stops working for anything new.
• Replacing the kit from another computer always brings up the “Did you do this?” prompt on your Macs.
• Without the kit and without any of your computers, your Cloud data can’t be recovered, by you or by Subcloak. That’s the cost of Subcloak never having your keys.

See Recovery Kit.

Share links

• The key stays in the #fragment. A link looks like https://subcloak.link/s/<id>#<key>. Browsers never send the part after # to any server, so the server stores encrypted pieces it can’t open.
• Decrypted in the recipient’s browser. The viewer page downloads the pieces and decrypts them with WebCrypto on the recipient’s computer.
• The app builds the link itself. The address of the share site is built into Cloak Proxy; the app never puts your key on an address the server suggests.
• Passwords never leave the browser or your Mac. A password is stretched with PBKDF2-HMAC-SHA256 (600,000 iterations) and mixed into the key. A wrong password fails before any requests are downloaded, so it doesn’t use up a view.
• Redaction happens before encryption, on your Mac, followed by an independent leak check. See Share links.
• What the server keeps: when the link was made and expires, its size, the view limit, the view count and the country of each view.

Sign-in and billing

• Sign-in is by emailed code, or a link you confirm. The link opens a page where you must press Confirm Sign-In, so a mail scanner that opens links can’t sign anyone in. Signing in only proves you own the email address: a new computer still needs approval or your Recovery Kit before it gets any key.
• Your Recovery Kit signs a new Mac in by itself. No code is emailed: the kit signs the new Mac’s keys, and the server checks that signature against your account’s recovery key. So a flood of sign-in emails can’t stop you recovering, and computers that are already signed in never need email again.
• Sessions are short-lived and kept in memory. Each request is also signed with the computer’s own key.
• Polar handles payments. Subcloak never sees your card. The server learns only whether you’re paying, and only Polar’s signed messages change your plan.
• Deleting data after a plan ends is double-checked. Before deleting a lapsed account’s data, the server asks Polar again whether it’s really unpaid, and deletes nothing if Polar can’t say.
• A stolen Mac can’t delete your account behind your back. A deletion always waits 72 hours. Every Mac shows it with Cancel Deletion, and the email to your address carries a cancel link that works without a Mac.

What’s stored on your Mac

• Your computer’s keys and the account key are in your login Keychain, available once you’ve logged in to your Mac.
• Cloud’s own files (your account state and sync records) are in a folder only your macOS account can read. The list of share links you made is encrypted with a key in your Keychain.
• The Recovery Kit PDF is saved readable only by your account. While the kit is on screen, the sheet is hidden from screenshots and screen sharing.
• Signing out deletes the keys and the Cloud folder. Your rules, mocks and workspaces stay.

Limits

No design protects against everything. These are the ones to know about:

• Metadata is visible. The server sees your email, how many computers you have, when you sync, and the rounded size of what you store. See what Subcloak can see.
• The server can refuse service or hold data back. Your Macs detect withheld or forked data and stop, but they can’t force the server to deliver it.
• Every computer you approve can read your data, and keeps what it synced after you remove it. Approve only computers you control, and compare the codes.
• Your Recovery Kit plus your email is a way in. Keep the kit offline.
• Computer names are chosen by the computers. When you’re asked about a change, check the short IDs and dates as well as the names.
• The share viewer is served by Subcloak. A compromised server could serve a viewer page that reads the key from a link as it’s opened. A password protects a link against that: the key in the link isn’t enough without it. Use one for anything sensitive.
• Redaction is pattern-based. It and the leak check catch common secrets, not everything. Read what you share.
• Your Mac’s own security matters. Malware running as you can read what Cloak Proxy can, Cloud or not.

Report a security problem

If you find a vulnerability in Personal Cloud, email hello@subcloak.com. See Subcloak’s security and disclosure policy. Test only your own account.

Related

Personal CloudWhat Cloud is and what syncs.

Review changes from another MacThe Did you do this? prompt and integrity warnings.

Recovery KitKeep it safe and use it.

Cloak Proxy security and privacyWhat the app keeps on your Mac.