Granite encrypts everything you store, with keys in layers so that no single key unlocks everything:
| Layer | What it protects |
|---|---|
| Vault key | Each vault's notes and files, with its own 256-bit key (AES-256-GCM) |
| Workspace key | The vault keys of one workspace or account |
| Master key | The workspace keys. It never enters the database or backups |
Traffic between your devices and Granite uses TLS 1.2 or newer. Read the full security model.