What our server sees
Culma's node stores your vault so your devices can find each other, and so there is a copy when a laptop is lost. It holds what is written below, and it can read what is written in the third column. This page lists the limits too, including the ones we would rather not have. If you find something missing from it, write to us and it goes in.
| What it is | What the node stores | What we can read | How long we keep it |
|---|---|---|---|
| Note content, titles, paths, folder names, whiteboards, attachments, view state | Sealed bytes. Every key is derived on your own devices and none of them reaches us. | Nothing. Titles and folder names are sealed with the content, which is the part almost nobody else does. | For as long as the vault's subscription renews it. After a lapse the cloud copy stays readable for 90 days and is then deleted; your own files are untouched. |
| Vault membership and roles | Sealed bytes. Who belongs to which vault is in the vault, not in our database. | Nothing. | With the vault. |
| Chunk addresses, kinds, byte counts, arrival times | The address of each sealed change, what kind of record it is, how large it was and when it arrived. | That something changed, how much of it there was, and when. A size is a fingerprint of a sort, and we would rather say so than let you discover it. | With the vault. |
| Device identifiers, and the public key a seat names on a keyed bucket | A device's own identifier, and the public half of the key a seat is bound to. | That a given device synced, and that a seat was presented. | With the vault. |
| Connection metadata and IP addresses | The ingress writes an access log, as every ingress does. | That an address connected, and when. | In preparationThis row waits on a written retention policy. We will not print a period we have not committed to, and we will not write "we log nothing" instead — the ingress logs. |
| What the issuer knows: a credential, a plan, a count of draws | A customer's credential, their plan, and how often it has been drawn against. | Who pays for what, and how much of it is in use. | In preparationThis row waits on the separate infrastructure and on a condition about shared logging. Until both are in place we make no claim that the two sides are separated. |
| Deletion: what a purge does and does not do | A purge removes the bytes from the bucket and records that it happened. | That a note was purged, and when. | The purge record persists, because every other device has to learn about it. And a shared folder's purge is not a recall: what somebody already downloaded, they keep, and we say so rather than implying otherwise. |
What this page does not promise
We do not say the node logs nothing; it logs little, and that is one debug line away from being false, so we tell you what it logs instead. We do not say anything is permanently deleted without saying what remains. We have not been independently audited and will not use the word until a report exists and is published here with its findings. And we make no claim about any law protecting you — the promise is cryptographic, not jurisdictional: there is nothing readable to hand over, in any country.
Last reviewed 19 October 2026.