News · Security at Blackbear

How Sharing Stays Sealed

Sharing is where most products quietly give up on encryption. The moment two people need the same document, the easy move is to decrypt it server-side and call it a feature. We did not take the easy move.

Blackbear shares files, folders, and live edits without handing us the keys. Here is how it works underneath.

Permissions are a signed document

Every shared space is governed by a capability schema: a small policy document naming each member and what they may do. The owner's device signs it. Each new version chains to the hash of the previous one and advances an epoch counter.

Once your device has seen a version of a space, it refuses anything older: version eight will never be replaced by version seven. A brand-new device has no history to compare against and starts from whatever it is first served; from that first sight onward, the ratchet holds. The server distributes policy. It cannot author it, and it cannot rewind it for any device with history.

One key, sealed per person

A shared space has a content key. Nobody mails it around in the open. It is sealed individually to each member's public key, and the server stores those sealed copies. It can hold every one of them and open none of them.

Roles that cannot be forged

Reader, commenter, editor, moderator, owner. Every role grant carries a signature from the person who granted it. Editing a database row cannot promote anyone.

Revocation rotates

Removing someone flips the epoch: the content key rotates and is re-sealed for everyone who remains. Everything shared from that moment on is dark to the person who left.

Honesty requires the other half: what someone already synced was already theirs. No protocol can reach into a device and un-send data. Anyone who claims their revocation does that is selling something.

Live editing is relayed ciphertext

Real-time collaboration streams encrypted CRDT updates through the server. It sees member fingerprints, key epochs, and sizes. It orders the stream and fans it out. The words appearing under your co-editor's cursor are opened on their device, not on ours.

Authorship is signed

Your actions are signed with your profile key. Pax signs with their own. What you wrote and what your assistant wrote stay cryptographically distinct, with no configuration on your part.

Your people do not pay

Sharing does not require the other side to pay. Content sealing works the same for every member, free or paid. And free guests participate fully in spaces a paying host sponsors: they message, they co-edit, they join calls, under the same access rules as everyone else. The rule underneath is simple: every relayed connection must include at least one host, and when the server cannot prove that, it refuses.

That is the series. Your content is sealed on your device before it travels. Our servers hold a short, published ledger of metadata. And sharing extends the seal instead of breaking it.