Security1 min read
End-to-end encryption for teams
Sharing securely inside a company is harder than for one person. How group keys, roles and revocation work without a server that can read along.
End-to-end encryption for teams
Sharing securely inside a company is harder than for one person. How group keys, roles and revocation work without a server that can read along.
One person with one key is simple. A team that adds and removes people, with shared vaults and roles, is where end-to-end encryption gets interesting.
Group keys
Each shared vault has a content key, wrapped to every member’s public key. Adding a member wraps the key for them; removing one rotates it.
- Invite wraps the vault key to the new member
- Roles gate actions, not decryption
- Removal rotates the key so old copies go stale
Revocation in an E2EE system is not “delete the row”. It is “change the lock and hand out new keys”.