What the server can access

Bearicorn is designed so the hub can coordinate chat and tasks without reading supported encrypted content. The hub still needs other information to operate the service.

Content the hub does not need to read

• chat messages and attachments;
• task comments;
• task titles, descriptions, and subtask titles; and
• task attachments.

This content is encrypted before upload and decrypted on an authorized device.

Information the hub can access or infer

• account names, roles, and permissions;
• team, room, task, membership, and device relationships;
• timestamps, delivery activity, and access patterns;
• attachment names, types, sizes, and upload progress;
• some task workflow and status information;
• IP addresses and ordinary server or proxy logs; and
• encrypted content and other service data stored in backups.

Operators should treat this metadata as sensitive even when message content is encrypted.

What an operator can still do

An operator controls availability and the software delivered by the hub. They can stop the service, delete or withhold stored data, manage membership through available administration features, retain backups, and deploy a modified web client.

That is why host security, HTTPS, code-review discipline, device security, and backups remain part of the threat model.

Backups

A database backup contains encrypted user content as well as service information such as accounts, membership, and timestamps. Encrypt backup storage, restrict access, and define a retention policy. Follow the backup and restore guide.