When you copy a password, a private message, or sensitive business information, that data shouldn't end up on someone else's server in readable form. Yet most clipboard sync apps do exactly that.
Quilon is different. We use a zero-knowledge content architecture: the service does not hold the keys needed to decrypt protected clipboard, message-body, or file-byte payloads. Account, routing, room, file, and audit metadata is still processed by the service.
What is Zero-Knowledge?
In Quilon, zero-knowledge is scoped to encrypted content and key custody. We see ciphertext and the operational metadata needed to authenticate, route, store, audit, and expire it, but not the client-held keys required to decrypt protected payloads. Sync keys are derived using PBKDF2-HMAC-SHA256 with 310,000 iterations and are not stored by the service.
This is fundamentally different from most "encrypted" services that hold the keys to decrypt your data for "account recovery" or "indexing." If they can decrypt it, they can be forced to share it.
How Quilon Implements Zero-Knowledge
1. Client-Side Key Generation
When you set up Quilon, your device generates a unique 256-bit encryption key. This process happens entirely on your local hardware. We don't have a "copy" of this key.
2. AES-256-CBC Encryption
Before any clipboard data leaves your device, it's encrypted using AES-256-CBC.
- Your clipboard content is serialized (text, image, or URL).
- A random initialization vector (IV) is generated for every sync.
- The content is encrypted with your key and the IV.
- Only the encrypted payload and HMAC signature are transmitted.
3. Real-Time Relay (No Storage)
Quilon's servers act as a relay—they pass encrypted messages between your devices via secure WebSockets but never store or decrypt them. Unlike Pushbullet or Paste, we don't keep a database of your clipboard history in the cloud.
What We Can See vs. What We Can't
For transparency, here's the data boundary:
- We CAN see: Your email, device/routing identifiers, encrypted payload sizes, and Ops operational metadata.
- We CANNOT decrypt: Protected clipboard bodies, image/file bytes, Ops message bodies, or room payloads.
With Quilon, encrypted content confidentiality does not depend on the service holding a decryption key. The remaining account and operational metadata boundary is documented separately in the privacy policy.