ZERO-KNOWLEDGE
We only ever hold ciphertext
The credential is encrypted in the submitter's browser before any network request. We store the ciphertext envelope only, and hold no key that can decrypt it. Reveal happens only in a technician's browser after a passkey step-up, there is no server-side decryption endpoint to abuse, subpoena or misconfigure.
ENFORCED, NOT PROMISED
A leak fails the build
A static invariant we call I-1 is checked by an automated test that walks every response and log and rejects any envelope field, link token, challenge code or recovery code. If secret material could reach the server, the test fails, so the guarantee is enforced in CI, not just asserted in marketing.
CRYPTOGRAPHY
Standards, not slogans
A random content key encrypts the fields with AES-256-GCM; that key is sealed to each recipient with HPKE (DHKEM P-256 / HKDF-SHA256 / AES-256-GCM), via the platform Web Crypto API. Keys are non-extractable where the platform allows, and the envelope format is versioned with a published validator. We describe the primitives, we don't say "military-grade".
RECOVERY
Nothing lost by accident
Each technician has a portable identity key, not a device-bound one, unlocked by a passkey, a 24-word (256-bit) recovery phrase, or a cached device. Recipients are explicit per request, with an optional org recovery key. A new laptop or a leaver never strands a credential; break-glass recovery and offboarding are built and tested.
ANTI-PHISHING
The user can tell it's really you
Every handover page is branded on your domain with named IT contacts. An optional spoken challenge code read out of band, and an optional emailed one-time code, mean a leaked link alone can't complete the flow, and a public link checker lets a recipient confirm provenance before opening.
TICKET LIFECYCLE
The record dies with the work
A handover is created from your ticket, a private note is written back, and it auto-purges when the ticket closes. That removes the orphaned-secret failure mode entirely, it's a control, not a convenience.
WHAT WE CAN SEE
To run the service and give you a complete audit trail, we keep the details of each handover: who asked for it, who it was for, when it was opened and which ticket it belongs to. The password itself is encrypted in the user's browser before it reaches us, and sealed to your technician's key. We never see the password, and we never hold a key that opens it, so there is nothing readable on our side for anyone to find. The technical detail is in our docs.
