Glossary

Client-side Encryption Data is encrypted on the user’s device before upload; the server stores ciphertext and can’t read the content.

Key Management Policies and systems for generating, storing, rotating, and controlling access to encryption keys.

Key Rotation Replacing encryption keys on a schedule or after incidents to limit blast radius from key compromise.

Access Control Rules defining who can view, edit, share, or export vault content (roles, permissions, scopes).

Least Privilege Security principle granting only the minimum access needed to perform a task.

Audit Log A tamper-resistant record of actions (logins, shares, exports, edits) used for accountability and incident response.

Data Retention Policies controlling how long content and logs are kept before deletion or archival.

Data Archiving Moving older, infrequently accessed data into long-term storage with integrity checks and retrieval paths.

Versioning Keeping historical revisions of items so changes can be traced, compared, and reverted.

Provenance Context about an item’s origin: source URL, capture time, author, method, and related artifacts.