Security is the boundary.

Facets is local-first and end-to-end encrypted. The useful question is not whether I can fit that into a slogan. The useful question is where the boundary is.

Local use needs no account. Sync does. The relay sees the metadata needed to route encrypted data. It does not receive the keys that decrypt your workspace content.

This page is the boundary in plain English: what the service sees, what it cannot decrypt, what the formal models cover, and where the protection ends.

Local work needs no account.

If you use Facets on one machine, there is no account and no relay. Your workspace is stored locally in SQLCipher. Nothing uploads unless you turn on sync, backup, or sharing.

Sync needs an account.

Sync has to know which devices and people belong to a Space. That creates account, device-link, membership, billing, and quota records. Clerk handles the website sign-in and device-link layer. It does not receive workspace plaintext.

The relay gets metadata and ciphertext.

The relay receives routing metadata and encrypted envelopes. It can parse invite, membership, and delivery fields. It does not receive the keys that decrypt your notes, tasks, docs, or files.

Encrypted sync is not invisible sync. The service needs metadata to link devices, route envelopes, manage membership, bill accounts, enforce quotas, and debug failures. That metadata is visible to the service. The workspace content inside the encrypted envelopes is not.

What the service can see

  • account identifiers and verified email state for sign-in
  • device-link records and device membership
  • Space membership, roles, and removal state
  • billing, plan, storage, and quota state
  • timestamps for sync, delivery, linking, and service logs
  • encrypted envelope records, object identifiers, sizes, and routing fields
  • network and operational logs needed to keep the service running

What the relay cannot decrypt

  • plaintext note and document text
  • plaintext task, reminder, calendar, and project content
  • plaintext file contents
  • workspace content inside encrypted sync envelopes
  • decryption keys for workspace content
  • local-only work that never uses sync

Parts of the security design are written down as formal models, and that is a much more useful sentence than a marketing slogan.

What the models are for

The models exist to catch the boring failure mode: saying the relay is untrusted, then accidentally giving it authority somewhere else. ProVerif, TLA+, and Isabelle/HOL are used around the protocol, state machine, and data model.

  • the relay is treated as untrusted, not as a place where plaintext appears
  • messages from one Space are rejected if replayed into another in the modeled design
  • removed devices lose future write authority in the modeled lifecycle
  • restore requires relinking before sync authority returns
  • trust checks depend on existing authority instead of inventing it after the fact

What they do not prove

The models are receipts for specific design claims. They are not a third-party audit and they are not a promise that every shipped line is perfect.

  • that every line of shipped code is perfect
  • that the product has been independently audited
  • that metadata disappears
  • that a compromised device is safe
  • that Clerk, Backblaze, Cloudflare, macOS, or the network can never fail
  • that an exported copy is still protected by Facets

Sync works by moving encrypted envelopes between devices. The relay accepts, stores, routes, and delivers those envelopes. It parses the unencrypted fields needed for invites, account linking, membership, and delivery.

The relay stores ciphertext and metadata. It does not store the decryption keys for workspace content. That is the content boundary: it can move the envelope, but it cannot open it.

Cryptography does not make a compromised endpoint safe. Facets cannot protect against:

  • malware or a keylogger already running on your device
  • someone using your unlocked machine
  • someone watching your screen
  • a malicious accessibility process on your system
  • a recovery phrase or passphrase handed to the wrong person
  • anything you export, screenshot, copy, or move out of Facets on purpose
  • relay downtime, blocked networks, or account-provider outages
  • bugs nobody has found yet

If the device is owned, the math does not save you. That is true of every end-to-end encrypted product; I would rather say it plainly than imply otherwise.

Facets has formal models, result notes, conformance work, and tests behind specific design claims. The relay server source is available. That is real evidence for the design boundary.

Facets does not have an independent third-party implementation audit or SOC 2. No outside firm has reviewed the full shipped product and signed off. If that changes, this page will say exactly what was audited, when, which version was in scope, and what was not.

The building blocks, so you can see where trust lives:

Rust, Tauri

native runtime for storage, crypto, sync, and the local trust boundary

SQLCipher

encrypted local storage

OpenMLS

group key agreement for sync envelopes

AES-GCM, HKDF, HMAC, SHA-2

encryption, authentication, and key-derivation primitives

Ed25519 Dalek

signatures for authority-bearing records

zeroize

best-effort cleanup for Rust-owned secret buffers

rustls

TLS for network transport

Passkeys

unlock your encryption keys on your Mac

Yjs, ProseMirror

collaborative document model and editor surface

Clerk

hosted identity dependency for sync device-linking and billing

Backblaze B2, Cloudflare Workers

encrypted object storage and relay infrastructure

ProVerif, TLA+, Isabelle/HOL

formal modeling and invariant-checking tools

Can Facets read my synced work?

No. The service stores metadata and ciphertext. It does not receive the keys that decrypt your workspace content.

Is Facets zero-knowledge?

I am not using that phrase. It hides the useful facts. Local data starts on your device. Synced content reaches the relay as ciphertext. Metadata still exists.

What does formally modelled mean?

Parts of the design are written down as models: the protocol, trust boundaries, state transitions, and data-model invariants. Tools check whether those models satisfy specific claims. That gives receipts for the design. It does not prove the whole shipped app has no bugs.

Has Facets had an independent audit?

No. Not yet. No outside firm has reviewed the full shipped product and signed off. If that changes, this page will say what was audited, when, which version was in scope, and what was not.

What if my device is compromised?

Then the problem is bigger than Facets. The design can keep plaintext away from the relay; it cannot make an infected endpoint safe. A compromised synced device can be removed so it stops receiving future authority.

What if Facets disappears?

Your local data stays on your machine and the app keeps opening it. A shutdown would affect hosted sync, billing, and cloud storage, not the local copy already on your device. That is the local-first part doing real work.

Found something? Report it privately first, and test with your own account and fake data — not someone else's work.

Contact me →