Cloud encryption and data storage

[mockinbirdy]

First off, this FAQ response sounds like a company trying to be clever with their words and not directly answering the question. Using overly descriptive language instead of simply saying "yes" or "no" and giving a full explanation of how it works in their app. To make matters worse, it only mentions local network and doesn't say a word about cloud storage.

Q: Does AFFiNE provide support for end-to-end encryption?

A: Certainly, AFFiNE extends robust support for end-to-end encryption (E2EE). Our platform prioritizes data security while fostering seamless teamwork within local networks. With AFFiNE, you can confidently leverage E2EE alongside local area network (LAN) collaboration. Moreover, our collaboration framework, based on Conflict-free Replicated Data Types (CRDTs), ensures that real-time collaboration remains unhindered by geographical constraints, network speeds, and even offline usage. We anticipate these improvements to be rolled out by the end of this year.

So...

How does end-to-end encryption work in AFFiNE cloud sync?
How is user data stored on AFFiNE servers?

Given that it's known that AFFiNE collects telemetry, it's important to clarify these points.

It's not explained in the FAQ, and there's no way to test it. This raises some red flags. It seems odd that a company promoting itself as an open-source Notion alternative with encryption would not proudly display such a significant feature with a clear and concise explanation, instead of being vague about it.

[EnterMan123]

That's one of my concerns

[ezxpro]

Came here looking precisely for that answer, since this was posted on march and now it's august and no one answered, I'll assume they just don't want to answer, which makes me think there's some shady business going on with this app's privacy.

But I still that's not the case, I'd really like some of the devs to take this discussion over @forehalo

[linkh2010]

I'd like to know how the data is stored in the database as well.

[forehalo]

I understand your concerns regarding privacy and data security. First and foremost, I assure you that users’ data is safe, and AFFiNE always prioritizes the privacy and security of its customers’ information.

During data transmission, AFFiNE uses secure protocols to prevent any potential interception, eavesdropping, or tampering. User data is stored in the database as unreadable binary code, ensuring it is not accessible in plain text. AFFiNE is continuously committed to enhancing the secure storage of user data.

Regarding telemetry, I would like to clarify that all data collected by AFFiNE is anonymous. This only includes functionality usages, program errors, and crash data, which are used solely to help us improve AFFiNE. Additionally, AFFiNE offers an option to completely disable telemetry or even run AFFiNE client in 100% offline(without sending any network request), and this setting is prominently available for users in the application settings.

Moreover, all of AFFiNE’s client-side code and release processes are openly available on GitHub, allowing the community to review and audit every action we take.

[negue]

AFFiNE uses secure protocols to prevent any potential interception, eavesdropping, or tampering

are these protocols E2EE? or "just" HTTPS?

[forehalo]

I would also like to add a clarification regarding the storage location of user data:

For users accessing app.affine.pro via a web browser:

• All local workspace data is stored within the browser itself, and AFFiNE has no way to access it.
• All cloud workspace data is stored on AFFiNE’s servers, following the secure storage methods described in my previous response.

For users of the AFFiNE Desktop client:

• All local workspace data is stored on the user’s PC file system, and AFFiNE has no way to access it.
• All cloud workspace data is stored on AFFiNE’s servers, following the secure storage methods described in my previous response.

For users running a self-hosted instance:

• All local workspace data is stored within the browser, and AFFiNE has no way to access it.
• All cloud workspace data is stored on the user’s own server, following the secure storage methods described in my previous response, and AFFiNE has no way to access that data.

[forehalo]

No data was applied to do anything. AFFiNE did not ever use any of users' data in any way, for selling, or to monetize, and we will never do that. That's our willing from the very beginning.

we've clarified over and over again. you are so welcomed to audit any actions AFFiNE has ever taken or will take.

[pstashp]

First of all, thank you for being responsive and answering our questions.

From browsing the code, I believe the answer to all this back-and-forth is the following (please correct any mistakes):

• No, the database isn't encrypted but in binary format (still considered plaintext, though)
  • I also don't see any KMS code to handle and store the derived encryption keys, so kind of supporting my guess here.
  • Also not seeing any code to handle shared keys for shared content (not sure how that is done in general, though).
• Transport layer is encrypted, but that's a given in today's standard, I guess.

[ezxpro]

@pstashp in the end, does this mean that data's not encrypted at rest?

[ezxpro]

@forehalo I see you didn't come back to this post. To me it seems like all you said above comes down to "we respect your privacy BUT with no E2EE".

When you say "User data is stored in the database as unreadable binary code" I'm really left wondering what is this even supposed to mean. It's a simple yes or no question. It either is or is not encrypted at rest.

Also it reads just like @mockinbirdy said;

" sounds like a company trying to be clever with their words and not directly answering the question"

You talked and talked and talked here and didn't answer these two simple questions:

How does end-to-end encryption work in AFFiNE cloud sync?
How is user data stored on AFFiNE servers?

And no, saying it's in "unreadable binary format" doesn't mean anything. If it's unreadable then how can it be accessed again? Mkes no sense. All we want to know is this: is it encrypted at rest?

1. YES
2. NO

As simple as that.

[ezxpro]

@forehalo still waiting for a comment...