Security and Data Storage

Where data lives

Nokuo's primary data lives in the local Vault folder you choose. That folder can be a normal local folder, or it can live inside iCloud Drive, OneDrive, Syncthing, Feiniu, NAS sync, or a similar local-sync tool.

The Nokuo service does not take over your plaintext workspace. It stores account data, login sessions, licenses, plans, and the metadata required to operate the service.

Encryption flow overview

Nokuo's default order is local encryption first, then sync or collaboration:

1. Create or open a local Vault.
2. The master password derives a local master key with Argon2id.
3. Each resource is encrypted with its own key, wrapped by the master key.
4. Sync and backup process encrypted Vault files.

Vault content uses XChaCha20-Poly1305. For the full algorithm, key model, and zero-knowledge boundary, see Encryption.

The Nokuo service does not store plaintext keys, plaintext settings, or plaintext content that can directly open your Vault.

What the service stores

The Nokuo service stores:

• account profile and login session data
• license, plan, and order state
• plan and license metadata

This data supports account access, purchasing, authorization, and collaboration boundaries. It is not used to host your plaintext materials.

What you need to keep

• Master password: used locally to unlock and derive encryption material.
• Recovery key: the last-resort recovery mechanism.
• Vault folder: your primary data directory.
• Sync storage credentials: if you use S3/R2/OSS/MinIO, you configure and manage those credentials.

If both the master password and recovery key are lost, the Nokuo service cannot reconstruct plaintext content for you.