2026-01-15 · · Daniel A

Client-Side Encryption: How We Protect Your Data

Client-side encryption (CSE) ensures your notes are encrypted on your device using AES-256-GCM before they reach our servers. By using Argon2id for local key derivation, SimplyBoard creates a zero-knowledge environment where only you hold the keys, protecting your data from server breaches, insider threats, and unauthorized access.

Client-side encryption (CSE) is a security architecture where data is encrypted on the user's device before it is ever transmitted to a server. At SimplyBoard, this means your notes are transformed into unreadable ciphertext in your browser using AES-256-GCM, with keys derived locally via Argon2id. Because the service provider never possesses the decryption keys, your data remains private even in the event of a server-side breach or legal subpoena.

"We take security seriously" is perhaps the most overused and hollow phrase in the technology sector. For most companies, this simply means they use HTTPS for transit and have a basic password hashing system on their backend. While those are necessary foundations, they do not protect your privacy from the service provider itself or from a sophisticated server-side compromise.

At SimplyBoard, we built a system where even we cannot access your data. This isn't about being difficult; it is about providing zero-trust data sovereignty. If we cannot read your notes, then neither can an insider threat, a hacker who breaches our database, or a government agency with a warrant.

The Zero-Knowledge Architecture

The core philosophy of SimplyBoard is "Zero-Knowledge." This refers to a system where the server has zero knowledge of the data it is storing. Client-side encryption refers to the practice of encrypting data on the user's device before it is transmitted to a remote server.

When you use SimplyBoard, the following workflow occurs:

• Your password is used to generate a unique encryption key locally in your browser.
• That key never leaves your device and is never sent to our servers.
• When you save a note, it is encrypted using that key before being uploaded.
• When you sync to a new device, the encrypted "blobs" are downloaded and decrypted locally using the password you enter.

Our database contains only encrypted strings that look like random gibberish. Without your specific password and the resulting key, that data is mathematically impossible to decipher.

Step 1: Key Derivation with Argon2id

A common mistake in encryption is using a password directly as a key. Passwords are often short or predictable, making them vulnerable to brute-force attacks. To solve this, we use a process called key derivation.

SimplyBoard utilizes Argon2id, which is widely recognized as the state-of-the-art algorithm for password hashing and key derivation. It won the Password Hashing Competition specifically because of its resistance to GPU and ASIC-based cracking attempts. We configure Argon2id with the following parameters to ensure maximum security:

• 64 MB Memory Cost: By requiring a significant amount of RAM, we make it prohibitively expensive for attackers to run millions of guesses per second on specialized hardware.
• 3 Iterations (Passes): This increases the computational time required for each attempt, further slowing down brute-force attacks.
• A Unique Salt: Every user has a unique, random salt stored on our server. This ensures that even if two users have the same password, their encryption keys will be completely different.

The result is a 256-bit key that is cryptographically strong, regardless of the original password's complexity. This entire process happens strictly in your browser.

Step 2: AES-256-GCM Encryption

Once the key is derived, we use AES-256 (Advanced Encryption Standard) in GCM (Galois/Counter Mode) to protect your content. AES-256 is the gold standard for symmetric encryption, used by governments to protect top-secret information.

We chose GCM mode because it provides "authenticated encryption." This means it doesn't just scramble the data; it also creates a mathematical "tag" that proves the data hasn't been tampered with. If even a single bit of your encrypted note is changed while sitting on our servers, the decryption process will fail, alerting you to the integrity violation.

The Encryption Payload

For every single save operation, SimplyBoard generates:

1. A Random 12-byte IV (Initialization Vector): This ensures that if you save the same note twice, the resulting encrypted data looks completely different both times.
2. The Ciphertext: Your actual note content, tags, and formatting, encrypted into a secure blob.
3. A 16-byte Authentication Tag: The digital seal that ensures data integrity.

What is Protected (and What Isn't)

To maintain a private notes environment, we encrypt the most sensitive parts of your workspace:

• Note Content: Every word you type in the editor.
• Tags and Metadata: The labels you use to organize your thoughts.
• Workspace Names: The titles of your different project areas.

However, to facilitate cross-device sync and account management, some metadata remains unencrypted:

• User Email: Required for login and account identification.
• Timestamps: Needed to determine which version of a note is the most recent (Last-Write-Wins conflict resolution).
• Entry IDs: Randomly generated UUIDs that link encrypted blobs together.

While some might prefer "zero-metadata," that approach often breaks the ability to sync efficiently or recover an account. We believe our model strikes the perfect balance between absolute content privacy and modern cloud convenience.

The Tradeoffs of True Privacy

Implementing client-side encryption involves significant technical tradeoffs that users should understand before committing to a PKM tool.

1. No Password Resets for Data

Because we do not have your key, we cannot "reset" your password to give you back your data. If you lose your password and your one-time recovery code, your notes are lost forever. There is no "Forgot Password" link that can decrypt your files. This is the price of true ownership.

2. Local-First Search

Most apps search your notes by running a query on their server. SimplyBoard cannot do this because the server can't read your notes. Instead, we use an instant fuzzy search that runs entirely on your device. We download your encrypted notes to a local IndexedDB cache, decrypt them once, and search them locally. This is why SimplyBoard feels so fast · it doesn't wait for a server to respond · but it does mean your initial sync on a new device takes a moment to process.

3. Limited Collaboration

Traditional "sharing" (like a public Google Doc link) is difficult with client-side encryption. To share a note, you would have to share your private encryption key. For now, SimplyBoard is designed as a private, personal workspace rather than a public collaboration tool like Notion or Miro.

Why SimplyBoard is Different

Many "secure" apps use server-side encryption, where the company holds the keys. This protects you if someone steals a hard drive from a data center, but it does nothing to protect you from the company itself or a hacker who gains administrative access to their software.

The difference between client-side and server-side encryption determines whether your encrypted data remains protected during a server compromise or insider threat. By moving the encryption to the "edge" (your browser), SimplyBoard ensures that your data is protected text from the moment it leaves your fingers.

We want to provide the fastest, most reliable offline-first note-taking experience without ever asking you to sacrifice your right to privacy.

If you have questions about our cryptographic implementation or want to discuss our security model, we invite you to reach out to our team at security@simplyboard.io.

· The SimplyBoard Team