Threat model
Security claims only mean something paired with their limits. This page is the honest version of what Trove does and does not defend against.
For the cryptographic primitives behind the points below, see Encryption.
What Trove protects against
Section titled “What Trove protects against”Passive server observation
Section titled “Passive server observation”Trove runs federation relays. They never receive keys and never decrypt anything. An operator with full access to the database and the request logs sees:
- Account metadata (handle, public key, membership lists).
- Ciphertext envelope sizes and timestamps.
They do not see manuscript content, chat content, Excerpt content, or titles.
A compromised relay
Section titled “A compromised relay”If a Trove relay — or an attacker who fully owns it — tries to read or modify your work, MLS authentication makes both moves fail. Tampered ciphertext drops at the AEAD tag check. Forged member additions fail because the relay does not hold any member’s signing key.
A leaked relay database
Section titled “A leaked relay database”The database holds public keys, ciphertext envelopes, and routing metadata. It does not hold key material that would let an attacker decrypt past or future traffic.
Forward secrecy of past sessions
Section titled “Forward secrecy of past sessions”MLS rotates group keys on every commit. Compromising your device today does not let an attacker read traffic from before the compromise — they would need keys that no longer exist.
Post-compromise security going forward
Section titled “Post-compromise security going forward”After a compromised device is removed from a group and the group commits, future traffic is private again. The attacker is locked out without the group needing to start over.
What Trove does not protect against
Section titled “What Trove does not protect against”A compromised endpoint device
Section titled “A compromised endpoint device”If an attacker has code execution on your laptop while you are signed in, they can read whatever you can read. End-to-end encryption defends the network and the server; it cannot defend a device that is already inside the trust boundary. Standard advice applies: keep the OS patched, use a screen lock, do not run untrusted binaries.
A malicious app update
Section titled “A malicious app update”Trove the binary is signed (Apple Developer ID, codesigned Windows builds). If an attacker controlled the signing identity and shipped a backdoored update, that update could exfiltrate your library. Mitigations:
- We publish release SHAs alongside each Release.
- Source is open; reproducible builds are a roadmap item.
Your backup choices
Section titled “Your backup choices”By default your files sit on disk as plain Markdown and TOML, so anything that can read the folder can read your writing. If you sync it through iCloud, Dropbox, or Google Drive, that provider can read it too.
Two ways to change that. Turn on Seal and Trove encrypts every manuscript, scene, draft, snapshot, and codex on that device behind a passphrase you choose — the files stay in place, but they are ciphertext until you unseal them. Or use full-disk encryption (FileVault, BitLocker, LUKS), which protects the whole machine rather than one app’s files. They work fine together, and neither helps against someone using your computer while it is unlocked and unsealed.
Traffic analysis
Section titled “Traffic analysis”Relays see envelope size and timing. An adversary watching both ends of the connection can correlate “Alice’s device sent a 4KB envelope to Bob’s relay at 14:02” with arrival at Bob’s device. MLS does not add cover traffic or padding. If traffic-analysis resistance matters for your threat model, route Trove through Tor or a VPN; the desktop app respects the OS proxy settings.
Coercion, subpoena, lost passphrase
Section titled “Coercion, subpoena, lost passphrase”Trove the company holds no key material, so we cannot decrypt your work for a court order or for you. If you lose both your Recovery passphrase and your 24-word Backup phrase, the account is gone. That is the trade — the same property that stops us reading your work stops us recovering it.
The other people in your Circle
Section titled “The other people in your Circle”When you share an Excerpt with a writing Circle, the members of that Circle can read it. They can also screenshot it, copy it, or repost it elsewhere. End-to-end encryption protects the wire, not social trust. Pick your Circles accordingly.
Reporting a vulnerability
Section titled “Reporting a vulnerability”If you find a flaw, please report it privately: contact support for the disclosure process.