Projects
/
Project record
Active
Research question
Fig. / gotin, suite 0x01: ciphertext behind the sealing front, plain text ahead of it. Illustrative, not real output.
Summary
Encrypted document intake, a Qwalora product. Each file is sealed on the sender’s device for a key only the receiving team holds, so the service stores copies it cannot open. Opens in January 2027.
Collaborators
Dates
–
Overview
gotin is an encrypted document-intake product operated by Qwalora LLC. A team sends one link; the person on the other side adds documents from any phone or laptop, with no account, and each file is encrypted on their device before it is uploaded. The service stores sealed copies, with no file names, no file types and no key.
It is listed here because its central design question is a research question: how far a production service can go in holding data it is unable to read, and how that claim should be specified so that someone else can check it.
Methodology
The design is written down as a fixed cryptographic suite, numbered 0x01, and published as a specification kept next to the code it describes. If any algorithm ever has to change, the new set receives a new number rather than being altered in place.
The code is reviewed against six written rules: no home-made cryptography; nothing sensitive in logs; unlocked keys live only in memory, in an isolated worker; fail closed; sealed files go straight between the browser and storage, skipping application servers; and pages that handle files or keys load no third-party scripts.
Technical approach
Suite 0x01: three published algorithms, each with one job
Key encapsulation: X-Wing, a hybrid of ML-KEM-768 and X25519. Each file key is sealed for the team’s key. Pairing a post-quantum method with a classical one means a sealed file recorded today stays sealed unless both are broken.
Content encryption: XChaCha20-Poly1305, an authenticated cipher. It encrypts what is inside a file together with its name and type, and detects any change made to the sealed copy.
Passphrase: Argon2id, a password hash that is slow on purpose. It turns a team member’s passphrase into the key that unlocks the team’s key on their device, making guessing expensive.
Sealing, on the sender’s device
A new random key is made for the upload. The files are encrypted with it, names and types included. That key is sealed for the team’s key. The sealed copy is padded so its exact size does not show, then goes straight to storage, and the device discards the key.
Opening, on the team’s device
The passphrase unlocks the team’s key, in memory only. The sealed copy is downloaded, the team’s key unseals the file key, and the files are decrypted and checked for changes. A copy that fails any check is refused; nothing partial is shown.
Activities and experiments
Suite 0x01 is being built and tested. Uploads on gotin.dev are paused until it is live, and the public pages describe how the service will work.
Designed but not yet in the suite: a passkey secret that binds an outside recipient’s link to their passkey on first open; a reveal layer for redacted packages that needs both that secret and a reveal password; uniform unlock counting, so the servers cannot tell which packages hold an original; a connector key held on a machine the customer runs; and receipt fingerprints for the received log and its daily anchor.
Outcomes and limitations
There are no results to report yet. No independent security audit has been carried out; the report will be linked from gotin’s security page when there is one.
The guarantee is bounded by the suite: it concerns what the service and storage hold. Protection of files on the sender’s and the team’s own devices sits outside what server-side design can provide.
Project records distinguish proposed, active, completed, and published work. Interim observations are not presented as findings.
Back to the project archive
Qwalora
Research & Development
The applied research practice of Qwalora LLC, a New Jersey limited liability company. Qwalora R&D is not an independently incorporated institute, university, or government laboratory.
© 2026 Qwalora LLC. All rights reserved.