Threat model
We assume device theft, network interception, and accidental exposure via backups or cloud sync. We assume the user's account credentials may be compromised. We do not assume state-level adversaries with physical access to unlocked devices — Fluera is not a secrecy tool, it is a study tool.
Within that model, three guarantees:
- Local data is unreadable without the key. A stolen device yields an encrypted blob.
- Synced data stays in the EU and is never sold. Cloud sync is encrypted in transit (TLS) and at rest on EU infrastructure, but it is not end-to-end encrypted — Fluera, as data controller, can technically access synced content. We never sell it or use it for advertising.
- Telemetry is consented and de-identified. Analytics cannot link a user to their content even if fully breached.
At rest: SQLCipher, AES-256
Every Fluera notebook lives in a local SQLite database encrypted with SQLCipher — a widely-audited extension that transparently encrypts every page of the database with AES-256-CBC and HMAC-SHA512 page integrity.
The local database key is a random 256-bit key generated by Fluera and kept in the platform's secure key store — Keychain on iOS/macOS, Keystore on Android, DPAPI on Windows, libsecret on Linux. It is not your account password or a cloud-sync passphrase, and the local database key is never sent to Fluera's servers.
In transit: TLS 1.3
All network traffic uses TLS 1.3 with modern cipher suites only, on every platform.
Cross-device sync: EU-hosted, encrypted in transit and at rest
Cloud sync, when enabled, stores your notebooks on Supabase (EU region, eu-north-1). Sync traffic is encrypted in transit with TLS, and the stored data is encrypted at rest at the infrastructure level. It is not end-to-end encrypted: Fluera, as data controller, can technically access synced content. We never sell it or use it for advertising. Sync is opt-in per notebook — you can keep some local-only while syncing others.
Your on-device database stays encrypted with SQLCipher regardless of sync. A password-protected .fluera export is encrypted separately with AES-256-GCM; its export password protects only that file and is unrelated to cloud sync.
P2P collaboration: direct, encrypted
Real-time collaboration uses WebRTC DataChannels with DTLS-SRTP encryption. Supabase Realtime acts as a signalling broker only — connection setup — not a relay for the actual canvas traffic. After handshake, canvas edits flow peer-to-peer. The server does not see them.
On restrictive NATs we fall back to a TURN relay, in which case the relay sees only encrypted DTLS packets it cannot decrypt.
AI calls: proxied, processed in the EU
AI features (Socratic mode, Ghost Map, LaTeX OCR, Exam Session) use Google Gemini models served via Google Vertex AI, processed in the EU (europe-west4 NL / europe-west1 BE). Calls transit a proxy that holds credentials server-side, so client devices never see them. The proxy enforces per-plan rate limits and logs call durations for accounting — never the content of the canvas.
If you opt out of AI features in Settings → Privacy, no canvas content is ever sent for AI processing, even for on-device OCR fallbacks.
Telemetry: opt-in, hashed, allowlisted
Product analytics are disabled by default. When enabled, events are restricted to a server-side allowlist (session start/end, feature invocation, AI call duration — never content). The user ID is hashed SHA-256 on the device; the raw ID never leaves. Events are retained for 180 days then aggregated or deleted.
Audit log (Education accounts)
Every access to shared notebooks — who opened it, from which device, when — is written to an append-only audit log. Administrators can export the log as CSV or JSON for compliance reviews. The log is write-once: deletion requires a documented business reason and is itself logged.
Data recovery
Synced notebooks are tied to your account: after the standard account-recovery flow, sign in again to download them on a new device. There is no separate cloud-sync passphrase to remember or lose. Account recovery cannot reconstruct a notebook that was kept local-only if its device data was erased; enable sync for notebooks you need to recover across devices.
Responsible disclosure
Security researchers are welcome. Report vulnerabilities to lorenco@fluera.dev with PGP encryption (key published on the GitHub profile). We acknowledge within 24 hours, patch critical issues within 72, and credit reporters in our hall of fame unless anonymity is requested.
Scope: the Fluera app (all platforms), the sync service, the AI proxy, and this marketing site. Out of scope: third-party services (Supabase, Google, Apple, Sentry, RevenueCat) — report those to the respective vendors.
External assessments
Fluera does not currently hold SOC 2 or ISO 27001 certification. These are on the Enterprise roadmap and will be announced publicly when complete. We prefer not to claim controls we have not independently verified.
The sub-processor list is published and kept current. The Data Processing Agreement is available on request via lorenco@fluera.dev.