How Locki protects your data

Text and files are encrypted and decrypted in the browser with AES-256-GCM, using the Web Crypto API built into every modern browser. Each value gets a fresh random 12-byte IV, so the same text never produces the same ciphertext twice.

Encrypted text stays wherever you put it — a Slack message, an email, a ticket — as a string that starts with [LOCKI:v2:. Without the key it can't be read, by the app that stores it or by anyone else.

Key backups exported from the extension are encrypted with a key derived from your password, using PBKDF2 with SHA-256 and 600,000 iterations.

Personal keys are generated in your browser and kept there. They are never sent to Locki.

Team keys are created in the admin dashboard. On our servers they are stored encrypted under a separate key, so a copy of the database alone reveals nothing. They are delivered over TLS only to signed-in members of the groups that have access. Rotating a key keeps earlier versions, so older content stays readable.

Every encrypt, decrypt and administrative action is logged with the person, the action, the key, the time and the site where it happened. The content itself is never logged — neither the original text nor the ciphertext.

The encryption library behind Locki, @lockisecurity/crypto-core, is public under the MIT license. Its tests run against the NIST AES-GCM test vectors from SP 800-38D, and anyone can read, run or reuse the code.

All connections are encrypted with TLS. Every request to our API is authenticated and limited to your organization, admin actions require the admin role, and requests are rate-limited. People sign in with their work email or their Google account.

We collect only what the service needs to run. The privacy policy explains what we process, why and for how long, and how to exercise your rights under the GDPR.

If you believe you've found a security issue in Locki, email security@lockisecurity.com with a description and the steps to reproduce it. We read every report, keep you informed while we investigate, and credit you if you'd like.

Please test only against your own account, don't access or change other people's data, and give us reasonable time to fix the issue before sharing details publicly. The same contact is published in our security.txt file.