Monetize insights without exposing raw data. Privacy-first by design.
Enable data-driven value extraction while preserving end-to-end confidentiality through cryptographic guarantees rather than trust assumptions.
This demo shows how a browser can encrypt a message with a recipient's public key, send the ciphertext to a server, and have the server decrypt it with its private key—all without ever transmitting the plaintext. It uses libsodium‑wrappers, the modern, audited NaCl implementation, keeping the cryptography solid while the code stays short.
| Traditional Model | Indos Model |
|---|---|
| Raw data shared with buyers | Insights derived locally, only aggregated results transmitted |
| PII exposure risk | Zero-knowledge architecture—plaintext never leaves owner's control |
| Compliance overhead | Built-in GDPR/CCPA alignment via design |
| Manual privacy reviews | Automated privacy controls via sealed-box encryption |
- Market Research — Aggregate sentiment without accessing individual responses
- Analytics Partnerships — Share metrics without revealing customer-level data
- ML Training — Contribute encrypted embeddings to federated learning pipelines
- Auditing — Prove compliance without exposing transaction details
- End-to-end encryption using X25519 + XSalsa20‑Poly1305 (libsodium sealed-box
crypto_box_seal). - Forward secrecy — ephemeral keys generated per message.
- Zero-knowledge transport – only ciphertext travels over HTTP (no plaintext, nonces, or key material exposed).
- API authentication — API key middleware protects decryption endpoints.
- Rate limiting — prevents abuse (20 req/15min on
/decrypt). - Security headers — Helmet.js enforces HSTS, X-Frame-Options, etc.
- TypeScript on both client and server for safety and autocompletion.
- Node ≥ 18 (native ESM support)
- npm (or yarn/pnpm)
- Git
# 1. Clone the repository
git clone https://github.com/indoscient/privacy-first.git
cd privacy-first
# 2. Install client dependencies
cd client && npm install
# 3. Install server dependencies
cd ../server && npm install
# 4. Generate server key pair (run once)
npm run gen:keypair
# 5. Copy outputs to .env files
# server/.env: PRIVATE_KEY, API_KEY, ALLOWED_ORIGINS
# client/.env: VITE_SERVER_PUBLIC_KEY, VITE_API_KEY, VITE_API_URLCreate .env files before starting:
server/.env:
PRIVATE_KEY=<from gen:keypair output>
API_KEY=<random 32-byte hex string>
ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3000
PORT=4000
client/.env:
VITE_SERVER_PUBLIC_KEY=<from gen:keypair output>
VITE_API_URL=http://localhost:4000/decrypt
VITE_API_KEY=<same value as server/API_KEY>- Terminal 1 – start the API:
cd server && npm run dev
- Terminal 2 – start the React dev server:
cd client && npm run dev
| Resource | Description |
|---|---|
| Client README | Front-end setup, scripts, and usage |
| Server README | Back-end endpoints, security controls |
| Privacy Design Decisions | Privacy-by-design controls and data flow |
Please read our CONTRIBUTING.md for guidelines on how to propose changes, run tests, and submit pull requests.
This project is licensed under the MIT License – see the LICENSE file for details.
Built with ❤️ by the Indos Team — Privacy First, Always.