{% extends 'shared/base.html' %} {% load static %} {% block title %} Security {% endblock %} {% block head %} {% endblock %} {% block body %}

Our Security Approach

Welcome to the Security section of sWarden. This page is a transparent, technical walkthrough of how your data flows securely through our system — from your browser to our backend, to the database, and back. Each step below recodesents a key step in the lifecycle of your encrypted secrets. We highlight which parts of the system handle your data, how cryptographic protections are applied, and what safeguards exist at each layer.

1

Browser

  • Uses Content-Security-Policy (CSP) with strict rules — no external source fetched.
  • All secrets (passphrases, notes, cards) are encrypted client-side before being sent to the server.
  • JavaScript encryption is powered by modern WebCrypto APIs and uses Argon2id.
2

Local Cryptography

  • Secrets are encrypted with a key derived from your master passphrase, using argon2id with a secure salt.
  • Each secret uses its own random IV (initialization vector).
  • No plaintext secrets are ever visible outside your browser tab.
  • The backend only sees encrypted blobs.
3

HTTPS Transmission

  • All requests are protected by TLS 1.3 (end-to-end encryption in transit).
  • HSTS, Referrer-Policy, X-Frame-Options, and other secure headers enforced.
  • Only essential cookies are sent (csrftoken, sessionid, etc.), all marked Secure, HttpOnly, SameSite=Strict.
  • CSRF protection handled by Django's CSRF middleware using the csrftoken.
4

Middlewares

  1. SecurityMiddleware – sets secure headers.
  2. WhiteNoiseMiddleware – serves static assets securely.
  3. SessionMiddleware – manages your encrypted, anonymous session.
  4. CommonMiddleware, CSRFMiddleware and AuthenticationMiddleware – add protection and request context.
  5. CSPMiddleware (django-csp) – blocks any unauthorized resources/scripts.
  6. XFrameOptionsMiddleware – codevents clickjacking.
  7. MessageMiddleware – handles secure server-side messages.
5

Backend Logic

  • Django, with only essential views.
  • No emails, phones, or names ever requested.
  • Logins use hashed credentials and session-based auth only.
  • Password Hashing using argon2-cffi with high-cost parameters (memory/time/hardening).
  • The server never knows what you're storing — it only processes opaque, encrypted payloads.
  • CAPTCHA is used for bot protection, with no third-party scripts.
  • Data is validated server-side but not decrypted.
6

Database (Encrypted at Rest)

  • Engine: PostgreSQL, connection via psycopg2-binary.
  • TLS-encrypted connection channel between Django and DB (even if local).
  • Are stored only encrypted secrets, metadata (timestamp) and anontmized accounts IDs.
  • Cryptography data based on secret application keys using argon2-cffi.
7

Response to Client

  • Response returns encrypted data — still unreadable by the server.
  • Only the browser with the correct passphrase-derived key can decrypt it.
  • No tracking pixels, third-party beacons, or behavior analytics are injected.
  • Static assets (JS/CSS/fonts) are served by WhiteNoise and never via CDNs.

Our Security Philosophy

At sWarden, we believe in security by design. Our approach is built on four core principles:

  1. Zero-Knowledge Architecture: We can never access your unencrypted data.
  2. End-to-End Encryption: Your data is encrypted before it leaves your device.
  3. Transparency: Our security practices and code are open to review.
  4. Defense in Depth: Multiple security layers protect against various threats.

Account Recovery Warning

Due to our zero-knowledge encryption model, we cannot restore your account access if you forget it's passphrase and lose your 12-words recovery list. There is no backdoor to your encrypted data.

  1. Make sure your master passphrase is something hard to guess but easy for you to remember.
  2. Keep your 12-words recovery list in a safe place OUTSIDE the digital world.
  3. Consider setting up emergency access for trusted contacts.
  4. Regularly test your recovery methods.
  5. Losing your master passphrase and 12-words recovery list means permanently losing access to your data.
{% endblock %}