Client KDF & envelope
Argon2id key derivation and AES-GCM envelopes are implemented in both C# and TypeScript against shared vector suites.
Security
Zero-knowledge is a tested property of the architecture, not a claim painted on after the fact.
What the server never gets
Master passwords and vault plaintext stay on clients. The AU API stores opaque encrypted blobs, sync metadata, and organisation membership — enough to move ciphertext between devices, not enough to open a vault.
Server assemblies are forbidden from referencing the client crypto library or decrypting AES-GCM payloads. That boundary is enforced by dedicated zero-knowledge tests.
Transport & ops
TLS terminates on Ripple’s shared ingress. PassStash customer names stay DNS-only on Cloudflare so client IPs remain visible for rate limits.
Hardening in flight
TOTP 2FA, JWT rotation / JWKS, and HIBP breach checks are implemented. Encrypted export/import and pepper-rotation runbooks continue to land.
Threat model honesty
A compromised client device can still expose unlocked vault material. PassStash’s promise is that a breached sync region cannot decrypt customer vaults from stored data alone.