Enterprise File Sharing With No Size Limits — In Any Region, On Your Storage

BYOS TRANSFER FLOW — ENTERPRISE CITADEL

Client Device (Sender)
  ├─ [1] AES-256-GCM key generated locally (never leaves device)
  ├─ [2] File encrypted chunk-by-chunk in memory
  ├─ [3] Encrypted chunks → written to YOUR storage bucket directly (currently Cloudflare R2; AWS S3, Azure Blob, GCS, MinIO on roadmap)
  └─ [4] Encrypted key envelope → sent to ShareBolt relay

ShareBolt Relay (zero-knowledge)
  └─ [5] Encrypted key forwarded to recipient DID (ShareBolt never decrypts)

Recipient Device
  ├─ [6] Decrypts key envelope with private key
  └─ [7] Pulls encrypted chunks from YOUR bucket → decrypts locally

Result: Your S3 bucket holds only encrypted ciphertext.
        ShareBolt holds only an encrypted key envelope.
        Neither alone can reconstruct the plaintext.

Supported Storage Backends

OIDC CLAIMS RESOLUTION — CLIENT-SIDE

function resolveEnterpriseAccess(oidcJwtToken, roomId) {
  // Parse claims entirely in browser/client memory — no server call
  const claims = parseOidcToken(oidcJwtToken);

  // Check role against organization-defined access policy
  const roomPolicy = getLocalRoomPolicy(roomId);
  if (!roomPolicy.allowedGroups.some(g => claims.groups.includes(g))) {
    throw new Error('SEC_AUTH_FAILED: Insufficient OIDC role claims');
  }

  // Decrypt room key envelope with session-derived private key
  return decryptLocalKeyEnvelope(claims.session_key, roomId);
  // Key never transmitted. Decryption is local. ShareBolt sees nothing.
}

Enterprise Key Takeaways

• Zero file size ceiling via BYOS — encrypted chunks write directly from client to your S3/R2/Azure bucket; ShareBolt is never in the data path.
• GDPR data residency enforced at the Cloudflare edge using cf-ipcountry routing — EU traffic stays in EU-central R2 buckets backed by separate credentials.
• Ed25519-signed audit ledger with hash chain including storage region — every field of every transfer is tamper-evident; a single modified record breaks all downstream blocks.
• BYOS bypass = stronger residency — enterprise tenants designate their own regional bucket; geo-routing is bypassed because the bucket itself is the declared jurisdiction.
• Dedicated edge Workers (99.99% SLA) — no shared runtime, no noisy neighbors, isolated Cloudflare Workers pool per tenant.
• HSM integration — vault master keys live entirely in FIPS 140-2 Level 3 hardware; no software key exposure on any tier.