Skip to content
OernoeOernoe
Create Account
Technical Whitepaper

Cloud Security & Encryption Architecture

How Oernoe Docs and Oernoe Drive protect personal documents and cloud files with layered cryptographic isolation, TLS 1.3, and AES-256 encryption at rest.

Updated 11 September 2026

Cloud storage and real-time document editing require robust cryptographic architectures to protect data against interception, unauthorized access, and unauthorized data mining. At Oernoe, our cloud architecture across Oernoe Docs (docs.oernoe.com) and Oernoe Drive (drive.oernoe.com) is designed with data isolation and modern encryption standards at every layer.

This guide details our multi-layer security architecture, key management lifecycle, transit protocols, and data disposal pipelines.

1. Encryption in Transit (TLS 1.3 & HSTS)

Every connection between client browsers and Oernoe cloud infrastructure is secured using Transport Layer Security (TLS) version 1.3 with strict forward secrecy (ECDHE key exchange) and authenticated encryption (AES-GCM / ChaCha20-Poly1305).

  • HTTP Strict Transport Security (HSTS): Enforced with a maximum age of 63,072,000 seconds (2 years) and includeSubDomains; preload headers to prevent SSL-stripping and man-in-the-middle attacks.
  • Modern Cipher Suites Only: Legacy protocols (SSLv3, TLS 1.0, TLS 1.1) and insecure ciphers (RC4, 3DES, CBC-mode ciphers) are permanently disabled at the edge router.
  • Secure Cookie Flags: All session tokens are marked with Secure, HttpOnly, and SameSite=Lax to prevent cross-site scripting (XSS) and cross-site request forgery (CSRF) token extraction.

2. Encryption at Rest (AES-256-GCM)

When files are uploaded to Oernoe Drive or documents are authored in Oernoe Docs, payloads are chunked and encrypted at rest using industry-standard AES-256 in Galois/Counter Mode (GCM).

AES-256-GCM provides both confidentiality and cryptographic integrity verification. Any unauthorized tampering or byte-level corruption of stored file chunks is immediately detected during decryption, preventing corrupted or injected payloads from executing.

3. Cryptographic Key Management & Scoping

Storage objects are segregated using a hierarchical key management strategy:

  1. Master Key Encryption: Hardware-backed Key Management Service (KMS) modules maintain rotated root keys.
  2. Per-User Key Derivation: Individual user data partitions utilize cryptographically derived keys (PBKDF2/Argon2) combined with high-entropy salt values.
  3. Per-File Data Encryption Keys (DEK): Each file chunk receives a unique DEK that is wrapped (encrypted) by the user’s key before storage.

This compartmentalized structure guarantees that a compromise of an individual file key cannot lead to the exposure of other files or accounts across the multi-tenant storage fabric.

4. Secure File Sharing & Ephemeral Links

When you share a document from Oernoe Docs or a file from Oernoe Drive, access is governed by cryptographically generated capabilities tokens:

  • Expiring Time-to-Live (TTL): Share links can be configured with strict expiration timestamps (e.g. 1 hour, 24 hours, 7 days), after which the capability token is permanently invalidated in our edge cache.
  • Passphrase Protection: Senders can attach an optional client-side passphrase that must be supplied before the server releases the decrypted payload.
  • Granular Role-Based Access: Docs collaboration supports explicit read-only, comment-only, or editor roles, preventing accidental modification by external viewers.

5. Zero Advertising Monetization & Isolation

Unlike ad-funded cloud platforms that index user documents and drive storage to train recommendation engines or deliver targeted advertising, Oernoe strictly enforces domain isolation:

  • No File Scanning for Advertising: The contents of your Docs and Drive folders are never scanned, analyzed, or categorized for advertising profiles.
  • Zero Third-Party Ads on App Surfaces: docs.oernoe.com and drive.oernoe.com do not load Google AdSense or any external ad scripts.
  • Publisher Separation: Only educational and guide articles on www.oernoe.com display contextual AdSense units.

6. Secure Deletion & Cryptographic Erasure

When you delete a file from Oernoe Drive or delete your Oernoe account:

The associated Data Encryption Keys (DEKs) are immediately destroyed from the key management system. This process renders the stored ciphertext mathematically unrecoverable across all storage blocks prior to physical block overwrite during routine garbage collection cycles.