Security

The server is a safe without its own key

It stores the encrypted content, but the key that opens it does not belong to it: it stays with brothers and sisters, on their devices. This is the differentiator, and below we trace precisely where the line runs, including the live video and audio of an online session, which with high privacy are now encrypted end-to-end as well, without promising the impossible.

The line, in full

What we cannot see, and what we can

What we cannot see

Encrypted end-to-end: it leaves the browser encrypted and stays encrypted.

The text of papers and uploaded documents
The minutes of the sessions
Members' display names (encrypted, distinct from the technical username)
The offices held and their terms (encrypted assignments)
Attachments and files uploaded to the archive (summonses included)
The cash register: amounts, descriptions, payments and charity (the charity box is anonymous even to the lodge)
The membership register: the dates of each member's journey, initiation, passing and raising (whether someone is active or unattached is instead metadata: see the right-hand column)
The reminders in the secretary's schedule (titles and dates)
The library: the titles in the catalogue and who has what on loan

What we see, and why

Metadata the service has to know in order to work.

That a lodge exists, and its administrative name (to route access and manage the service).
How many accounts and how many members it has (to apply the limits of the plan).
The dates and times of the meetings on the calendar (to share them with those attending; a meeting is a common event, not private content).
The opaque usernames (technical identifiers, not names) (to authenticate without exposing anyone's real identity).
The size and timing of the encrypted data (to store and serve it; its size is unavoidably known).
That the treasury is in use, and the rhythm of its entries (to store the encrypted entries; their content stays sealed).
The state of a member's journey (active, unattached, resigned, passed to the Grand Lodge Above) (to close access when that state requires it; the dates of the journey stay encrypted).
Attendance at meetings, when the lodge chooses to record it (to give the secretary the picture of attendance).
That reminders and library entries exist, how many and when written (to store them encrypted; titles, dates and names stay sealed).

An honest note: even metadata alone tells a story: the rhythm of the sessions, the growth of a lodge. We do not encrypt what the server needs in order to operate, and we prefer saying so to hiding it. This holds for online sessions too: the live video and audio are now encrypted end-to-end with high privacy, but their metadata stays visible: who is connected at that moment (with temporary identifiers), the times, and who is speaking. We explain it below.

Online sessions

The session by video call: the live stream, encrypted end-to-end

A lodge can hold the session from a distance too, in a virtual room with the setting of the Temple, as well as in person. The entrance stays guarded: a digital Tyler welcomes at the door, the vetting stays a human act in real time and no one enters on their own. And like the rest of the archive, with high privacy the live video and audio are encrypted on the devices of those present: what reaches our server are opaque envelopes it cannot open. Only the metadata stays visible, and we say so openly.

The live video and audio are encrypted end-to-end (high privacy)
Like papers, minutes and the treasury, the live stream of an online session too is encrypted on the devices of those present: the key of the meeting is born and stays on your browsers, and what reaches our server are opaque envelopes it cannot open. The server routes the encrypted streams in real time, so that each may see and hear the others, without seeing their content.
We record nothing and keep nothing
The room does not record. When the sitting closes, we keep no copy of the streams: our server routes them as they pass, encrypted, and does not store them, nor could it read them.
No third-party video service
The server that routes the streams is ours and lives on the same European infrastructure as the rest of the service. The sitting is not entrusted to outside providers.
Which sessions are held online, we do not know
That an event has a room, and the coordinates to enter it, live in the encrypted content of the summons: the server does not know which meetings take place from a distance. At the door the names of those present are assigned by the Tyler; during the sitting we know only who is connected, with temporary identifiers and not with real names.
What stays visible, and the browsers that cannot sustain it
High privacy hides the content, not the metadata: who is connected (with temporary identifiers), the times and who is speaking stay visible. And it requires a recent browser: if someone uses a browser too dated for live encryption, their stream falls back to the clear and the room declares it to everyone, so that no one believes protected what at that moment is not.

Under the bonnet

The technology, in brief

Content encryption: XChaCha20-Poly1305, with a random content key for each document.
Lodge key: encapsulated with an X25519 sealed box (Curve25519): one single key pair for the lodge, shared with every member and kept only on their devices.
From password to key: derivation with Argon2id on the device; the password never leaves the browser.
Library: libsodium, standard and well-tested primitives, no proprietary algorithms.
Rotation: the lodge key can be rotated by re-wrapping the content, without decrypting it on the server.
Seal on printed documents: an Ed25519 signature applied in the browser of those appointed; anyone can check it at /verifica, in their own browser, without the content ever reaching us.
Degrees and offices: permissions, not separate keys: Inside the lodge, who can read which content is governed by the service's access rules, according to degree and offices, not by different cryptographic keys: to anyone not admitted the server hands over neither the metadata nor the content key. Towards the server and towards the outside, by contrast, privacy stays cryptographic: the content stays encrypted end-to-end and the lodge key lives only on the members' devices.

A detailed technical document is available on request.

The way out

Take your data with you, or truly delete it

You can export your archive at any time. And deletion is final by construction: once the keys are destroyed, the encrypted data becomes unreadable noise: crypto-shredding, which leaves no plaintext copy anywhere.