Help

How encryption works

CYLO is a sealed vault. The hosting layer stores ciphertext. Nobody at TLC, and no admin on the roster, can unwrap your files.

1. You choose a vault passphrase (10+ characters). This browser runs PBKDF2-SHA-256 at 210,000 iterations to derive a key-encryption key. The passphrase never leaves the device.
2. A random vault master is generated and wrapped under that KEK. Only the wrap is stored. Unlocking unwraps the master into this tab; Lock and closing the tab clear it.
3. Each file is sealed with AES-256-GCM as a CYLO1 envelope. The filename is a second envelope (AAD cylo-name).
4. Cylo stores those envelopes in an object bucket. Sharing re-seals an independent copy with a one-time key — your vault master is never in the link.

Join with an invite

You cannot create an account on an already-configured workspace without a token — unless the owner opened signup.

1. Open the invite link you were sent (it starts with cyloinv_), or go to Sign up and paste the token.
2. Create an account with the email the invite was bound to, if it was bound. Open invites accept any address.
3. Press Accept. You are now on the roster as operator or admin.
4. You still have to create your own vault passphrase next. The invite is not a key to anyone else’s files.

Join without an invite

1. If the owner turned on Open signup or Signup, then approve, the splash offers Create account.
2. Create the account. Open signup puts you on the roster as operator immediately.
3. Approval mode leaves you on a waiting screen until an admin or operator presses Approve on Team or Accounts.

Found the first workspace

Only when Cylo has never been configured. The first signed-in account becomes owner.

1. Open Cylo. You land on Initial setup.
2. Sign in or create the owner account.
3. Name the workspace and continue.
4. Create a vault passphrase (see below).
5. Optionally issue the first teammate invite, or skip and do it later from Team.

Create a vault passphrase

This is the only secret that can unwrap your files. Cylo cannot reset it.

1. After you join (or during setup) you see Create vault.
2. Type a passphrase of at least 10 characters. Type it again to confirm.
3. Write it down offline. Do not store it next to the files.
4. Submit. This browser derives a key, generates a vault master, and wraps that master. Only the wrap is stored.

Sign in later

1. Open Sign in.
2. Use the same email as before.
3. You land on Vault, locked, until you enter the passphrase.

Unlock the vault

Needed before you can see names, preview, download, share, or write notes.

1. Go to Vault. The card says Unlock vault.
2. Enter Vault passphrase.
3. Press Unlock. A toast confirms. The master lives only in this tab.

Lock the vault

1. Open Manager and press Lock now, or use Lock vault on Account.
2. The master is cleared from memory. Envelopes on the server stay sealed.
3. Closing the tab also drops the session master. Unlock again next time.

Seal files from disk

Encryption always runs before upload. A 50 GB log is one vault object, stored as 8 MB sealed chunks.

1. Unlock Vault.
2. Press Choose files and pick one or more, or drop them on the dashed pane.
3. Watch the progress bar. When it finishes, the files appear in the current folder.
4. Kind badges (image, log, pdf…) are only hints for preview. They are not the filename.

Write a note

1. On Vault press Write.
2. Set File name. Choose Markdown (headings, lists) or Plain text.
3. Type the body. Press Seal note.
4. The note is encrypted and stored in the folder you are in.

Create a folder

1. On Vault press More → New folder.
2. Type a name (for example Contracts) and press Create.
3. You are placed inside that folder. The breadcrumb at the top lets you go back up.
4. Folders are path prefixes, not a separate table. Nested depth max 6. Names with .. are rejected.

View or download a file

1. Unlock Vault and find the file. Use the search field to filter by name, type, or source.
2. Press the eye control to preview images, PDFs, text, and a few office types. Preview decrypts in this browser only.
3. Press the download control to save the original bytes with the original content type.
4. HTML and SVG download as generic binaries on purpose, so they cannot run as pages.

List, grid, compact, sort, and filter

Long names wrap onto two lines so the page width stays put. Hover a name for the full string.

1. On Vault, Team files, and share lists, use the view toggles: list, grid, or compact.
2. Sort by newest, oldest, name, size, or type. Share lists also sort by opens left and expiry.
3. Share lists filter by status (active, expired, exhausted, revoked) and audience (link, named email, team roster).

Copy, move, archive, or delete

1. On a file or folder, open the ⋯ menu.
2. Copy duplicates the sealed object into a destination folder. This counts against quota.
3. Move renames the sealed path. Bytes stay put — no extra quota.
4. Archive zip decrypts the current selection in the browser and downloads a zip. Treat that zip as plaintext.
5. Delete removes the envelope (and its chunks). There is no recycle bin.

Share a file

Use this for people outside your team, or for an anonymous / email link. Teammates already open new vault files after they unlock — no extra password.

1. Unlock Vault. On the file press Share.
2. Who can open it: Anyone with the link (no account), Named email (they must sign in as that address), or Passphrase copy for the roster (optional extra copy; teammates enter that passphrase on Team files).
3. Set Expires (1 / 7 / 30 days) and max opens (No limit, or 1 / 5 / 20 / 100).
4. Passphrase is optional for link and email — use it if chat apps strip the # fragment. Roster copies always require a passphrase. Send that on a second channel.
5. Press Create share link. For link and email, copy the full URL. The fragment after # is the unwrap key and is not stored by Cylo.
6. Press Open to check a link share, then Done.

Share a folder

1. On the folder card press Share. Empty folders cannot be shared — add a file first.
2. The same dialog as a file share. Cylo packs the folder, reseals that pack with a one-time share key, and issues a link.
3. The recipient browses files on the share page. This is a snapshot, not live access to your vault.

Open a share you received

1. Open the full URL you were sent.
2. If the link is bound to an email, sign in as that address first.
3. If the # fragment is missing, enter the share passphrase the sender gave you.
4. Preview or download. Each open counts against the share’s open limit unless you chose No limit.

Revoke a share you issued

1. Open Manager → Your shares.
2. Press Revoke on the live row. Cylo stops serving that envelope.
3. Already-downloaded copies are not pulled back. If this browser created the link, Open still works until you revoke.

Download the whole vault

1. On Vault press More → Download vault.
2. Choose Encrypted pack to keep envelopes sealed. Set a pack passphrase (10+ characters, twice) and press Download encrypted. Opening it later needs that passphrase.
3. Or choose Decrypted pack and press Download decrypted. Files inside are in the clear — do not send that file.

Open a vault file

1. On Vault press More → Open vault file.
2. Pick a .cylo (or zip) pack.
3. A decrypted pack imports straight in. A sealed pack asks for Pack passphrase, then Unlock.
4. Imported files are re-sealed into your vault and count against quota.

Switch light and dark

1. Use the sun/moon control in the header, or the same control on Account.
2. The choice stays in this browser only. It is not a workspace setting.

Destroy this vault

Deletes envelopes, keys, shares, and the wrapped master for your account. The roster is unchanged.

1. Open Manager → Destroy vault, or the same control on Account.
2. Type DESTROY and confirm.
3. This cannot be undone. Teammates keep their own vaults.

Invite a teammate

Owner can invite admins or operators. Admin can invite operators. Team admins can add people to a team by email.

1. Open Team. Under Teams, pick a team (every workspace has a default team) or create another.
2. Enter their email and press Invite. If they already have an account they are added immediately. Otherwise a workspace invite is issued together with team access.
3. Copy the full invite link for people who do not have an account yet. Existing accounts are added immediately and receive team files after they unlock — no extra password. If outbound mail is configured, CYLO emails new-user invites.
4. Workspace-only invites (no team wrap) still live under Issue an invite on Team or Admin → Accounts. Those admit the roster. After they unlock, a teammate who already has access grants team files automatically.

What the teammate does

1. They open the invite URL, sign up or sign in, then press Accept.
2. They create their own vault passphrase. Unlock the vault — team files then open with no extra password.
3. New files they seal appear in teammates’ My vault lists, with a badge. They can place those files into their own folders without moving the owner’s copy.
4. If invite approval is on, Accept queues them. Open Team or Accounts → Access requests and press Approve.

See what teammates uploaded

Team-wrapped files appear in My vault and under Shared with you. Unlock once. No extra password.

1. Unlock Vault. Files from teammates show a badge with their name or the team.
2. Open or download them like your own. Use Place in folder to sort a share into your folder tree, or Copy to my vault for a private resealed copy.
3. Anonymous links and named-email shares still work from Share. Optional roster-passphrase copies remain under the Team files tab.

Approve a signup

1. Open Team (operators) or Admin → Accounts (owners and admins).
2. Under Access requests, press Approve or Deny.
3. Denied people stay signed in. They can request again if the workspace is still in approval mode.

Change a role or remove someone

1. Owner/admin: open Admin → Accounts (or Team).
2. Find the person (search matches name or email).
3. Change Role and save. You cannot demote the last owner.
4. Remove drops console access immediately. Their envelopes stay sealed until an admin deletes them from Inventory.

Set how much someone can store

1. On Admin → Accounts, each row has a personal quota control (number + B/KB/MB/GB/TB, or Unlimited).
2. Click a chip, or type an amount, pick a unit, and leave the field — it saves on blur.
3. Workspace quota and Max per file live on Admin → Overview and on Team (owners and admins).
4. 0 / Unlimited means no cap. Objects larger than 8 MB are stored as sealed chunks either way.

Issue an ingest key for a shipper

Shippers POST already-sealed envelopes. The key never unwraps a vault.

1. Unlock your vault first.
2. Open Access keys.
3. Type a Key name (for example shipper) and press Issue key.
4. Copy both secrets now: the cylo_ API key and the ingest key (base64). They are shown once.
5. The shipper seals with the ingest key and POSTs to ingest with Authorization: Bearer cylo_…. Objects appear in your vault.
6. Revoke the key on the same page to stop new uploads. Already-stored envelopes stay.

Open the console

1. Sign in as owner or admin. Admin appears in the nav. Operators who open it see a refusal, not the roster.
2. Sub-pages: Overview, Accounts, Inventory, Shares, Activity, Health, Core.

Change maximum file size or vault size

1. Open Admin → Overview (or Team).
2. Max per file — click a chip, or type any amount and pick B / KB / MB / GB / TB. Check Unlimited for no cap.
3. Workspace quota is the same control, for the whole team’s sealed bytes.
4. Personal quotas are per person on Accounts. The tighter of personal and workspace applies.
5. A change is audited. Existing files are not rewritten; the new cap applies to the next seal or ingest.

Configure the core

1. Open Admin → Core.
2. Cluster timing applies on the next heartbeat. Safe while the store is running.
3. Defaults affect new invites, shares, and joining members only.
4. Envelope bucket and node name are owner-only. Tick the warning, save, then restart the core. Changing the bucket does not copy envelopes already written. Object-bucket keys stay in the process environment.
5. Listen address, database URL, and the core secret stay in the process environment. This page will not rotate the secret.
6. Who can join — Invite only (default), Signup then approve, or Open signup. Tick the warning if you leave invite-only. Invite approval makes accepted invites wait in the same queue.

Erase this instance and start over

Use this when first-run already ran once and you need a clean owner account plus workspace.

1. Sign in. On Setup, press Erase this instance and start over. Owners can also open Admin → Core → Erase this CYLO.
2. Leave Also delete owner and operator accounts checked so setup starts at step 1 again.
3. Type RESET THIS CYLO and press Erase this CYLO. There is no undo.
4. Reload Setup and create the owner account, then the workspace, then the vault.

Browse sealed inventory

1. Open Admin → Inventory. Each page is 25 envelopes. Names stay encrypted, so they are not searchable.
2. Filter by member, kind, or source, then Search. Next / Previous walks a keyset cursor — it will not dump millions of rows.
3. Remove deletes the envelope (and chunks) and returns the charged bytes to quota. You still cannot read the filename or body.

Revoke any live share

1. Open Admin → Shares.
2. Press Revoke on the row. The link stops serving. Downloads already taken are not pulled back.

Read the operator trail

1. Open Admin → Activity.
2. You see who uploaded, invited, revoked, or changed quota — not filenames, not plaintext, not share fragments.

Read cluster health

Live nodes is how many cores have heartbeaten recently, not a count of signed-in people.

1. Open Admin → Health. It refreshes every 15 seconds.
2. Live nodes shows live of known, plus whether envelopes sit in a local bucket, an object bucket, or in the database.
3. In flight is HTTP requests this moment. Bandwidth is lifetime in/out, rolled up by hour on the chart.
4. A row older than 90 seconds is stale. After a restart, the previous process name drops off within a few minutes.

Run a multi-user workspace on SQLite

1. Many members on one core is the normal case. SQLite with WAL serializes writes. Isolation still holds: no shared master, no admin decrypt.
2. Do not start a second core against the same SQLite file. Writers will lock or the file can corrupt.
3. To run more than one core: put metadata in Postgres, put envelopes in a shared bucket, and give each process a unique node name. Health then shows multiple live rows.