Data Security

Data is persisted into Hive flat binary blocks inside the OS-protected application sandbox. No external partition writes. No shared world- readable directories.

On boot, the active box hydrates into RAM. Reads serve from memory at 0ms disk delay. Writes update the in-memory registry instantly, then flush asynchronously.

Rocen ships with no network permissions wired to user data flows. No background sync daemon, no analytics beacon, no remote config fetch.

A try-catch handshake monitors next-boot integrity. Broken blocks are isolated and purged before the runtime mounts, preventing cascading state damage.

The user password is stretched into a 256-bit master key with Argon2id — the memory-hard, side-channel-resistant KDF selected by the Password Hashing Competition. Memory cost, iteration count, and parallelism live in a tunable parameter slot so the work factor can be raised as device silicon improves.

Every note is sealed with AES-256-GCM before it is written to Hive. GCM is an authenticated encryption mode — decryption fails loudly on any bit-flip, truncation, or tampered ciphertext block. Nothing that lands on disk is readable without the master key.

A cryptographically-secure RNG produces a fresh salt for the vault's Argon2id derivation and a fresh 96-bit nonce for every AES-GCM write. Salts and nonces are never reused across records, sessions, or devices — the single hard failure mode of GCM is engineered out.

The vault key can be reconstructed from a 12-word backup phrase drawn from the BIP-39 standard 2048-word English wordlist. The phrase is shown to the user once, on-device, and is the sole recovery credential — Rocen holds no copy, no hint, no reset mechanism.

Optional backup pushes the already-encrypted vault blob to a private repository under the user's own GitHub account. Authentication uses a fine-grained personal access token that the user generates, scopes to a single repo, and sets to expire. Rocen has no server, no relay, no key escrow — the ciphertext leaves the device sealed and lands in an account only the user controls.

• > REMOTE EXFILTRATION ........ NOT APPLICABLE (NO NETWORK)
• > ACCOUNT TAKEOVER ........... NOT APPLICABLE (NO ACCOUNTS)
• > CLOUD BREACH ............... NOT APPLICABLE (NO CLOUD)
• > DEVICE COMPROMISE .......... DEFER TO OS SANDBOX
• > PHYSICAL ACCESS ............ DEFER TO OS LOCKSCREEN
• > BRUTE FORCE ................ MITIGATED (ARGON2ID)
• > TAMPERING .................. DETECTED (GCM AUTH TAG)
• > NONCE REUSE ................ N/A (RANDOM PER WRITE)
• > LOST DEVICE ................ RECOVERABLE (BIP-39 + GITHUB BLOB)
• > GITHUB TOKEN LEAK .......... SCOPE-LIMITED / USER-REVOCABLE