Security at Circadia

Zero-knowledge means we've architected the system so that we cannot access your unencrypted data—not “won't” but can't. This is a fundamental design principle, not a policy choice.

What We Can See

• Your email address (for account recovery and notifications)
• Encrypted data blobs (meaningless without your keys)
• Metadata needed for sync (timestamps, data sizes)
• Subscription status and billing information

What We Can't See

• Your mood entries, episode states, or symptoms
• Your journal entries, thoughts, or reflections
• Your medications, dosages, or adherence data
• Your sleep data, health metrics, or patterns
• Any personal health information you track

Circadia uses a multi-layer key hierarchy with industry-standard cryptographic algorithms:

Key Hierarchy

Cryptographic Standards

Recovery Mechanism

During account setup, you receive a 24-word recovery phrase (BIP39 mnemonic). This phrase can regenerate your KEK if you lose access to all devices. We do not store this phrase—if you lose it and all authenticated devices, your data cannot be recovered.

Passkeys (Primary)

Circadia uses passkeys (WebAuthn/FIDO2) as the primary authentication method. Passkeys provide:

• Phishing resistance—credentials are bound to the specific domain
• No password to remember, forget, or have stolen
• Hardware-backed security on modern devices
• Biometric confirmation (Face ID, Touch ID, Windows Hello)

Magic Links (Fallback)

For devices or situations where passkeys aren't available, we offer magic link authentication:

• Single-use links sent to your verified email
• 15-minute expiration window
• Rate-limited to prevent abuse (max 5 per hour)

Session Security

• Access tokens: 1-hour expiration, JWT format
• Refresh tokens: 30-day expiration, secure rotation
• Device limits: Maximum 5 concurrent sessions
• Remote logout: Revoke any device from settings

Biometric Protection

The app requires biometric authentication (Face ID, Touch ID, or device passcode) to access your data, even on an already-unlocked device.

Auto-Lock

• Configurable timeout (default: 5 minutes)
• Locks when app goes to background
• Requires re-authentication on return

Screenshot Prevention

Sensitive screens display a blur overlay during screenshots and screen recordings to prevent accidental exposure of your data.

Secure Data Storage

• iOS/watchOS: Keychain with Secure Enclave, SwiftData with encryption
• Web: IndexedDB with client-side encryption, no plaintext storage

Jailbreak/Root Detection

The app detects compromised devices and provides warnings, with graceful degradation of security-sensitive features on rooted/jailbroken devices.

Transport Security

• TLS 1.3: All connections use modern TLS with forward secrecy
• Certificate Pinning: Mobile apps pin our SSL certificate
• HSTS: HTTP Strict Transport Security enforced
• No HTTP: All traffic is HTTPS, no fallback

API Security

• Rate Limiting: 60 requests/minute for sync, 5 login attempts/5 minutes
• Input Validation: All inputs validated with Zod schemas
• CORS: Strict origin validation

Cloud Infrastructure

• Cloudflare Workers: Edge computing for low-latency, globally distributed API
• Neon PostgreSQL: Serverless database with encryption at rest
• Cloudflare R2: Object storage for encrypted file uploads
• Durable Objects: Real-time sync coordination

Data Residency

Your encrypted data is stored in data centers within your selected region. We support data residency preferences for users in the EU, US, and other regions.

Backups

• Automated daily backups with 30-day retention
• Backups are encrypted at rest (same zero-knowledge guarantee)
• Point-in-time recovery available

Development Security

• Code review required for all changes
• Automated security scanning in CI/CD pipeline
• Dependency vulnerability monitoring
• Secrets management with environment isolation

Operational Security

• Principle of least privilege for all access
• Multi-factor authentication for all team members
• Audit logging for administrative actions
• Incident response procedures documented and tested

Compliance

While Circadia is not a medical device and not subject to HIPAA, we follow security best practices that align with healthcare data protection standards. Our zero-knowledge architecture exceeds typical compliance requirements by ensuring we cannot access protected health information.

For security-related inquiries, concerns, or to report a vulnerability:

For urgent security matters, please include “URGENT” in your email subject line.