Skip to content

Security & trust

Hive is end-to-end encrypted and the relay is content-blind. This page states the guarantees you can rely on when a workspace syncs through a relay. A local-only workspace (no relay) puts nothing on the wire and is unaffected by everything below.

E2EE is mandatory for relay sync

Hive refuses to push plaintext to a relay. A workspace configured for sync but with no workspace key does not sync — the app surfaces a Sync error telling you to configure a key. The relay therefore only ever holds sealed (E2EE) bodies; there is no "encrypt later" mode that leaks cleartext in the meantime.

The workspace key never transits the relay

The key is exchanged out-of-band:

  • The hivews1: invite code carries the key inside the code itself, so share the code over a channel you trust — paste it directly to the joiner. See the invite code format.
  • Invite by GitHub handle seals the key to the invitee's devices instead, so nothing sensitive is copy-pasted — the key still never touches the relay.

The old relay-brokered "short code" that published the key to the relay's pairing store has been removed; the relay is never a party to key exchange.

The relay is content-blind

Every envelope is sealed with ChaCha20-Poly1305 before it leaves the device; the relay stores and forwards ciphertext only. It cannot read your traffic, and because it never holds the key it cannot help you recover a lost one.

Authorization is enforced on ingest, not just at authoring

Governance is re-checked when a synced event is projected, not only when it is authored. A membership change, a MemberRoleChanged, or a workspace-config change from an author who lacked the required role is dropped during projection — deterministically, on every device, so convergence is preserved.

A malicious member therefore cannot forge a validly-signed MemberRoleChanged{ self: Viewer → Owner } to seize the workspace: the signature verifies, but the author's role at that point did not permit the change, so every peer drops it. Membership is workspace-wide (via the config log) and roles are Owner / Admin / Contributor / Viewer.

The workspace founder is pinned via the invite: the invite carries the founding identity, and projection only accepts the real founder's seed as the base snapshot. So a malicious keyholder can't forge a competing base to hijack or fork the workspace out from under everyone else.

What this page does not cover

Private key seeds live as files on disk, not in an OS keystore — see Identity & devices for what protects them and Self-hosting a relay for connection-level access control.