# Encryption & Storage

Your browser generates an encryption key derived from your wallet signature using standard key derivation. This key is ephemeral — it lives only in the browser's JavaScript context, is never serialized, never persisted, and never sent to any server. If you reload the page, the browser re-derives the same key deterministically from a fresh signature.

Before any data leaves your device, your browser encrypts it with AES-256-GCM. The ciphertext is the only thing that reaches the ZDrive worker. Even if the worker's infrastructure were fully compromised, attackers would get encrypted blobs with no key material.

For vault storage, encrypted ciphertext is bundled into an ANS-104 DataItem, signed by the operator's key, and uploaded to Arweave via Irys node2. Once mined, the data is replicated across thousands of Arweave nodes globally and cannot be deleted, modified, or taken offline by any provider. The Arweave transaction ID is returned to your browser as proof of upload.

Permanence is the key property. Unlike cloud storage, Arweave data outlasts the provider. You own the transaction ID; you can retrieve your encrypted vault from any Arweave gateway. Since only your browser holds the decryption key, the data is cryptographically useless to everyone else.

## Vault upload flow

```mermaid
sequenceDiagram
    participant B as Browser
    participant W as CF Worker
    participant BC as Base Chain
    participant I as Irys node2
    participant A as Arweave

    B->>B: Derive AES key from wallet signature
    B->>B: AES-256-GCM encrypt(plaintext) → ciphertext
    B->>W: POST /vault/upload
    Note over B,W: Headers: x-wallet-address, x-wallet-sig, x-wallet-session, x-vault-tags
    Note over B,W: Body: ciphertext (binary)
    W->>W: verifyWalletIdentity()
    W->>BC: credits(wallet) → must be > 0
    alt Credits == 0
        W-->>B: 402 — purchase credits to unlock vault
    end
    W->>W: Parse x-vault-tags (Space token ID, etc.)
    W->>W: createSignedDataItem(ciphertext, operatorKey, tags)
    W->>I: POST /tx/ethereum (ANS-104 DataItem binary)
    I->>A: Bundle + settle fees → permanent storage
    I-->>W: {id: arweaveTxId}
    W-->>B: {id: arweaveTxId}
    Note over B: Only ciphertext ever left the browser
```

## Key derivation model

```mermaid
flowchart LR
    A["Wallet\n(private key)"] -->|"Sign auth message"| B["Signature bytes"]
    B -->|"Key derivation function"| C["AES-256-GCM key\n(ephemeral, browser-only)"]
    C -->|"encrypt(plaintext)"| D["Ciphertext"]
    D -->|"Sent to worker"| E["Irys / Arweave"]
    C -.->|"Never leaves browser"| VOID["✗ Server\n✗ Worker\n✗ Database"]
```

## Storage properties

| Property             | Value                                          |
| -------------------- | ---------------------------------------------- |
| Encryption algorithm | AES-256-GCM                                    |
| Key storage          | None — derived on demand from wallet signature |
| Upload target        | Arweave via Irys node2                         |
| DataItem format      | ANS-104 (Arweave standard)                     |
| Signer               | Operator ETH key (Irys node2 balance)          |
| Retrieval            | Any Arweave gateway using TX ID                |
| Deletability         | None — Arweave is permanent                    |
| Who can decrypt      | Only the wallet that encrypted                 |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.zdrive.io/architecture/storage.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.