How End-to-End Encryption Works in CipherDrive Stages

Stages is still an experimental feature being rolled out gradually. Check your Cloud Drive for the "Stages" option.

CipherDrive Stages applies end-to-end encryption to the live collaboration itself, not only to a file saved after the work is finished.

The public Stages architecture describes a browser-encrypted model in which CipherDrive coordinates encrypted state without needing to interpret the board.

1. A Stage key is created in the browser

A fresh AES-GCM 256-bit Stage key protects the canvas state before transmission.

The Stage title and initial empty canvas are encrypted in the browser as part of Stage creation.

2. Stage collaboration state is encrypted before transmission

The published model identifies the following as browser-encrypted:

Presence and live collaboration therefore do not require CipherDrive to receive plaintext canvas state.

3. CipherDrive coordinates ciphertext

CipherDrive stores and synchronizes encrypted Stage operations and snapshots.

The coordination layer receives ciphertext and is designed so that snapshots and operations remain opaque to it.

In the product's own model: the server coordinates the room; it does not read the board.

4. Authorized members receive wrapped access

The Stage key is individually wrapped to each authorized Stage-ready Ackaia identity.

Authorized member browsers can use their access to decrypt Stage state locally.

The published security model describes:

5. Removing access rotates the Stage key

When someone loses Stage access, their identity immediately loses access and CipherDrive rotates the Stage key.

Future changes and active key envelopes are then secured for the remaining members.

This prevents an access-removal workflow from relying only on a server-side permission flag while continuing to use the same active collaboration key indefinitely.

Drive files keep their encrypted file model

Files brought from CipherDrive remain encrypted files. The public Stage flow describes wrapped file-key access for authorized Stage members and states that ciphertext remains ciphertext in transit and storage.

New images pasted or dropped into a Stage are encrypted before being saved to the contributor's dedicated Stage folder in CipherDrive.

What Stages encryption does not change

End-to-end encryption protects the Stage from the service reading its encrypted collaboration content, but authorized participants can still see content they are permitted to decrypt in their own browsers.

Only invite identities you trust with the information placed in a Stage, and remove access when a participant no longer needs it.

Stages extends CipherDrive's privacy posture into a live multi-user canvas: creation, synchronization, presence, and membership are designed around encrypted client-side state.