User Guide

📂 Enroll a Folder

HybridCipher protects an enrolled folder. You can enroll any folder on your device (via the desktop app or the command line interface).

• Choose any folder: pick a location that fits your workflow
• Enrollment brings files under protection: existing files in the folder are processed after enrollment
• Ongoing protection: files added later are encrypted automatically

🔒 How Encryption Works

After enrollment, HybridCipher continuously protects the folder by encrypting file data and managing keys on your devices.

• Files inside the enrolled folder are encrypted automatically (including files added later)
• Each file uses its own randomly generated file key
• In a team, access is governed by the group’s current epoch (and rekeying when membership changes)
• You keep working with files normally; encryption and decryption are handled by HybridCipher

☁️ Works With Any Cloud Sync Folder

HybridCipher does not replace your cloud provider. It encrypts locally, and your existing sync tool uploads what is in the folder.

• Enroll a folder that is inside a synced path (for example, Google Drive, Dropbox, OneDrive, Nextcloud, Syncthing)
• Your provider stores and syncs the folder contents; HybridCipher’s goal is for those contents to be encrypted
• You can switch providers by moving the enrolled folder into a different sync path (no format lock-in)

🔄 Use on Multiple Devices

To access the same encrypted data on another device, install HybridCipher there and connect it to the same synced folder.

• Install HybridCipher on each device you want to use
• Sign in (and join the same team/group if applicable)
• Point HybridCipher to the same synced folder location
• Files remain encrypted at rest and decrypt only on authorized devices

👥 Team Collaboration (Groups)

In HybridCipher, a “team” is implemented as a cryptographic group. Groups define membership, roles, and the keys used to protect shared files.

• Create a team (group): Set up a shared encrypted workspace backed by a group key
• Roles: Admin and Member roles for managing membership and settings
• Invite members: Members gain access by joining the group—no manual key exchange
• Membership changes: Removing someone updates group access and triggers rekeying options

Terminology: UI may say “Team”, while the cryptographic object is a “Group”.

🔑 Epoch Key System (Group Key Versions)

Each group maintains an epoch (a key version) that changes when membership changes.

• Files are protected with per-file keys; access is governed by the group’s current epoch
• When membership changes, the group advances to a new epoch
• Removed members do not receive new epoch keys, so they cannot decrypt new content
• To revoke access to previously shared files, a rekey operation is needed (see below)

🚫 Access Revocation & Rekeying

Removing a member stops future access immediately, and rekeying removes access to previously shared data.

• Immediate effect: Removed members stop receiving new epoch keys
• Rekey past files: Re-wrap or re-encrypt existing file keys under the new epoch
• Automatic or manual: Rekeying can be triggered automatically (or run on-demand), depending on team settings
• Performance: Typically seconds to minutes depending on file count and hardware (for example, ~10,000 files may take ~15 seconds on a modern machine)

📊 Audit Logs

Audit logs help teams review membership and key events for accountability.

• Record membership changes and key-related events
• Tamper-evident integrity via cryptographic commitments (for example, Merkle commitments / hash chaining)
• Exportable logs for internal review (reporting tooling may vary by plan and maturity)

📚 Additional Resources

• • FAQ page - Answers to common questions
• • Technical Documentation - Deep dive into cryptography and architecture
• • Security & Threat Model - Security design and assumptions

💬 Feedback & Feature Requests

Your feedback shapes the product roadmap. Share suggestions, report bugs, or request features at support@hybridcipher.com