Cryptographic architecture

Your data,
unreadable even to us.

leggit applies modern end-to-end encryption standards. Here is, in plain words, how it works — and why it protects you.

The principle: zero-knowledge

"Zero-knowledge" literally means: leggit has no knowledge of the contents of your vaults. Your data is encrypted on your device before being sent, and the key that decrypts it never leaves your machine, nor that of your recipients.

Learn more
1 2 3 4 5

Shamir Secret Sharing

For account recovery or post-mortem release, leggit splits a critical key into several mathematically linked pieces. For instance into 5 pieces, of which 3 are required to reconstruct the secret.

Learn more
Bonjour x7Kf2#9q

Envelope encryption

Each item (text, file, message) is encrypted with a unique random key called the Data Encryption Key (DEK). That DEK is itself encrypted with your master key, derived from your password using Argon2id (a costly algorithm that resists massive attacks).

Learn more
✓

Audit and transparency

Every cryptographic operation is logged with a timestamp. You can review your vault's access history at any time: who saw what, when, and from where. For E2EE personal vaults, sensitive details (titles, previews) are themselves encrypted with your master key inside the log — only you can read them back via your browser.

Learn more
RGPD conforme ★ ★ ★ ★ ★

GDPR compliance

leggit complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act. You always have the right to access your data, correct it, export it, and erase it permanently.

Learn more
Documentation cryptographique complète Attestation de conformité E2EE