Vault

The vault is a secure space, accessible via Astry's web interface, for storing secrets, keys, documents, procedures, certificates, and more. You can access it from your Astry workspace, under the Settings tab, then Vault.

It relies on one fundamental principle: end-to-end data encryption. In practice, this means that data stored in the vault is encrypted before being sent to Astry's servers, remains encrypted at rest on the servers, and is only decrypted when you retrieve it, and only after being requested. Neither Astry administrators nor our hosting provider can therefore access the data in clear text. The cryptographic mechanisms involved are described further below.

User experience

Setting up the vault

The first time you set up your vault, you must choose a password. This is used to encrypt your vault's private key (see next section), and therefore to decrypt the data stored in it. Warning: this password is never transmitted (nor stored) on Astry's servers, so it cannot be recovered by our teams if you lose it, and documents stored in your vault will not be recoverable (or decryptable).

Uploading a document

Once your vault is set up, you can start uploading documents to it. To do so, simply go to the Upload a document section and follow the instructions. Anyone within your organization can upload a document, and the password set up in the previous step is not required (it is only used for decryption, see the next section). You can also, via the Astry API, upload documents programmatically (by providing an API key).

Retrieving a document

To retrieve a document, go to the Retrieve a document section and follow the instructions. You will then need to enter the password set up above.

Cryptographic mechanisms

Several cryptographic mechanisms are used, for different purposes:

1. Encryption of data in transit between your browser and Astry's servers is handled in a very standard way by the TLS protocol. It ensures the confidentiality and integrity of exchanges between your browser and Astry's servers, but it is not what provides end-to-end encryption or the impossibility for our teams to access your data in clear text.
2. Encryption of data at rest on Astry's servers is handled by RSA asymmetric encryption:
   • whose public key (used to encrypt your vault's data) is known and stored on Astry's servers
   • and whose private key (used to decrypt your vault's data) is not known to Astry's servers. This private key is randomly generated in your browser the first time you set up your vault, and is itself encrypted using a symmetric AES-256-GCM key protected by a password of your choice, unknown to our servers, before being sent to us.

The use of these mechanisms during the document upload phase can be illustrated as follows:

1. The user (via the Astry Web UI) calls an API to retrieve their vault's public key (no password is required here).
2. They then select, in their browser, which files from their disk they want to upload to their vault.
3. The Astry Web UI encrypts the data on the fly using the public key retrieved earlier, and sends it to Astry's servers.

Note: this upload step can be performed by a human via the Web UI, but also programmatically via the API (by providing an API key).

Conversely, to retrieve a document, the process is as follows:

1. The user (via the Astry Web UI) calls an API to retrieve both their vault's private key (which is itself encrypted using the password set up above) and the encrypted documents they want to retrieve.
2. They then enter, in the Web UI, the password set up above.
3. The Astry Web UI decrypts the vault's private key on the fly (using the password provided), then decrypts the retrieved documents (using the vault's private key).

Uploaded documents, the password set by the user, and the vault's private key are therefore never transmitted (or stored) on Astry's servers.