It is open to you to see how Kelender stores data in its database while keeping ai as a mind with the world's best encryption methods & architecture. Free to contribute, share and reuse.
Kelender is a software, closed source while few things are open from us. This repository is one of those open pieces -- a fully transparent look into how we store, encrypt, and protect every piece of data.
We believe security should not be a black box. That is why we open our encryption architecture for the world to inspect, learn from, and improve.
| Principle | Description |
|---|---|
| End-to-End Encryption | Data is encrypted before it leaves the client and only decrypted by the intended recipient |
| AI as a Mind | AI processes operate on encrypted data, never exposing raw information |
| Modular Architecture | Each encryption layer is independent, replaceable, and auditable |
| Open and Transparent | Every algorithm, every layer, every decision -- visible to all |
┌─────────────────────────────────────────────────┐
│ Client Side │
│ ┌───────────┐ ┌──────────────────┐ │
│ │ Raw Data │──>│ AES-256-GCM │ │
│ └───────────┘ │ Encryption │ │
│ └────────┬─────────┘ │
│ │ │
│ ┌────────▼─────────┐ │
│ │ RSA-4096 Key │ │
│ │ Wrapping │ │
│ └────────┬─────────┘ │
└────────────────────────────┼────────────────────┘
│
┌────────────────────────────▼────────────────────┐
│ Server Side │
│ ┌─────────────────┐ ┌──────────────────┐ │
│ │ Encrypted │──>│ Database │ │
│ │ Payload │ │ Storage │ │
│ └─────────────────┘ └──────────────────┘ │
│ │
│ ┌─────────────────────────────────────────┐ │
│ │ Zero-Knowledge Proof Verification │ │
│ │ (Server never sees plaintext) │ │
│ └─────────────────────────────────────────┘ │
└──────────────────────────────────────────────────┘
- Node.js (v18 or higher)
- npm / yarn / bun
- Git
- OpenSSL (for key generation)
git clone https://github.com/kelender/Kelender-Backend-Encryption.git
cd Kelender-Backend-Encryption
npm install
npm run keys:generatenpm run devnpm run buildKelender-Backend-Encryption/
├── src/
│ ├── encryption/
│ │ ├── aes.ts # AES-256-GCM implementation
│ │ ├── rsa.ts # RSA-4096 key management
│ │ ├── hashing.ts # Argon2id password hashing
│ │ └── keys.ts # Key derivation and rotation
│ ├── database/
│ │ ├── schema.ts # Encrypted data schema
│ │ ├── migrations/ # Database migrations
│ │ └── index.ts # Database client
│ ├── middleware/
│ │ ├── auth.ts # Authentication layer
│ │ └── validation.ts # Request validation
│ ├── routes/
│ │ └── index.ts # API route definitions
│ └── app.ts # Application entry point
├── keys/ # Encryption keys (gitignored)
├── package.json
└── README.md
All user data is encrypted using AES-256-GCM before being stored.
- Confidentiality (256-bit key)
- Integrity (GCM authentication tag)
- Nonce-based uniqueness per encryption
AES keys are wrapped using RSA-4096 for secure key exchange. The server holds only the public key -- it can never decrypt data on its own.
User passwords are hashed using Argon2id, the winner of the Password Hashing Competition. Memory-hard and resistant to GPU/ASIC attacks.
The server verifies user identity without ever learning the password or decryption keys. Authentication happens through cryptographic proofs.
Security is a collective effort.
- Fork the repository
- Create a feature branch
- Commit your changes
- Push to the branch
- Open a Pull Request
- Follow existing code conventions and patterns
- Document any new encryption schemes thoroughly
- Include security considerations in your PR description
- Peer review is mandatory for all encryption-related changes
- Report security vulnerabilities privately -- never in public issues
Found a vulnerability? Do not open a public issue. Contact the Kelender security team directly.
This project is licensed under the MIT License -- see the LICENSE file for details.
© Kelender · kelender.com