Helio: Zero-Knowledge Encrypted Document Vault

A personal document security vault architected on zero-knowledge cryptographic principles. Features client-derived PBKDF2 encryption keys, AES-256-GCM payload encryption, granular role-based access control, and immutable audit logs on a high-throughput FastAPI backend.

GitHub Repository code Request Demo Access mail

— CIPHER AES-256-GCM

— KEY DERIVATION PBKDF2-HMAC

— BACKEND FastAPI & Postgres

— MODEL Zero-Knowledge

— ARCHITECTURE OVERVIEW Verified Cryptosystem

Helio zero-knowledge encryption architecture and cryptographic schema

Cryptographic vault schema & zero-knowledge envelope encryption GitHub north_east

— PROBLEM & SOLUTION

warning Cloud Storage Server-Side Breach Risks

Conventional cloud storage providers hold encryption master keys on their own servers, leaving sensitive personal records exposed to insider threats, data breaches, and subpoenas.

verified Client-Side Key Derivation & Envelope Encryption

Helio computes 600,000-iteration PBKDF2 keys exclusively in client memory. Files are encrypted with random AES-256-GCM symmetric keys before any byte leaves the device.

— SYSTEM ARCHITECTURE

Client Cryptographic Boundary

Web Crypto API derives 256-bit AES keys from user master passwords; plaintext never touches network transit.

FastAPI Stateless Controller

Handles encrypted ciphertext chunks, JWT validation, and RBAC permission checks without holding decryption keys.

PostgreSQL Ciphertext Store

Stores cryptographically blind metadata, initialization vectors (IVs), and SHA-256 integrity verification hashes.

— KEY CAPABILITIES

vpn_key

Zero-Knowledge

The server possesses zero decryption capability; even database admins cannot inspect vault contents.

history_edu

Tamper-Proof Audit

Every file access and modification is cryptographically hashed and logged to an append-only audit trail.

lock_person

Granular RBAC

Scoped capability tokens allow time-limited read or write sharing with public key re-encryption.

— TECHNOLOGIES EMPLOYED

Python 3.11 FastAPI PostgreSQL SQLAlchemy Cryptography (hazmat) Web Crypto API Docker

Audited against OWASP Cryptographic Storage Cheat Sheet and NIST SP 800-132 standards.

— ENGINEERING CHALLENGES & RESOLUTIONS

memory Challenge: Browser Memory Exhaustion on Large Files

Loading large 200MB+ PDF documents directly into browser memory for AES encryption caused tab crashes and memory leaks.

Resolution: Architected a Web Worker streaming encryption pipeline using Chunked Transfer Encoding that digests files in 4MB chunks with deterministic authentication tags.

sync_saved_locally Challenge: Key Recovery Without Central Custody

In zero-knowledge architecture, forgotten master passwords result in catastrophic, irreversible data loss.

Resolution: Implemented Shamir's Secret Sharing scheme (3-of-5 threshold) generating offline paper recovery shards that can reconstruct vault keys without central escrow.

arrow_back Previous: News Scraper grid_view Back to All Projects Next Case Study: PrintFlow arrow_forward