How this handles your keys, and what it does not promise

Keys are generated on your machine

Each device makes its own Ed25519 keypair the first time it enrols. The private half never leaves that machine — not to Flanner, not to your own administrator.

A device id is a hash of the public half, so nothing assigns it and nobody can issue you one. That is also why a browser cannot enrol a device on your behalf, and why forwarding an invitation enrols the other person's machine rather than yours.

What this does not cover: The private key is stored in your OS keychain where one is available, and otherwise in a file created 0600. Anyone with your logged-in user account can use it.

Every artifact is signed at the source

Plan versions, comments, review decisions, tombstones and shared memories are all signed by the machine that created them. A receiving device verifies the signature against the author's public key from the organisation keyring.

The peer that hands you an artifact is not the peer you trust. A hostile device can offer whatever it likes; anything it did not legitimately receive fails verification and is dropped.

Entitlements are short-lived and checked locally

The control plane signs a statement of which workspaces a device may enter and with what role. Devices verify it themselves, offline, so syncing works with the control plane unreachable.

They last a day. Revoking a device or removing a member takes effect when the entitlement next renews rather than needing a revocation broadcast to arrive.

What this does not cover: An expired entitlement stays usable through a grace window for reads, so a device that has been offline still works. Writes require a current one, which caps the window in which a revoked device can push at one lifetime rather than a lifetime plus the grace.

Requests are signed and replay-protected

A peer request carries a signature and a nonce. The nonce is spent after the signature is checked and never before, so a captured request cannot be replayed even within the clock-tolerance window.

Being reachable grants nothing. A caller needs a signed request and an entitlement naming both its own device and the workspace it is asking about.

Content travels device to device

Plans and memory move over an encrypted QUIC connection between your machines. Flanner's servers store accounts, device public keys, workspace membership and billing. They never receive plan or memory content.

Devices find each other by public key. There is no VPN to install, no port to open and no administrator rights needed: each machine dials out and answers on that connection.

The relay cannot read what it forwards

When two machines cannot reach each other directly, an encrypted relay forwards the bytes. It sees that two devices are exchanging something, and not what.

Whether a device may use the relay is derived from the same facts as its entitlement, so a cancelled subscription stops relay use without a second list to keep in step.

What this does not cover: Traffic analysis is not addressed. A relay operator can see connection timing and volume between two endpoints.

Secrets are refused before they are stored

Anything written to memory is checked against eighteen credential patterns plus an entropy test — on what you type, on what an agent proposes, and again on anything a teammate sends you.

A peer's signature proves who wrote something. It is not this device's judgement about whether to keep it, so the check runs on received content too.

What this does not cover: It is a pattern and entropy check, not a proof. A credential that resembles ordinary prose can pass it. Treat it as a backstop, not as permission to paste secrets.

Withdrawal is a request, not an erasure

Withdrawing a shared memory, or retiring a plan, signs a tombstone that peers honour: they stop recalling and stop advertising it.

A device that already received the content still has the bytes on its disk. No design without a central copy can reach into somebody else's machine, and Flanner does not claim to.

What this does not cover: If content must be provably destroyed, this is not the tool for it. That is a property of holding no central copy, which is the same property the rest of this page sells.