Security Architecture

Zero-knowledge. Air-gapped.
Always verified.

Grovia Vault is built on the principle that security cannot be bolted on after the fact. Every layer — from key derivation to storage — is designed to resist compromise, even if the Grovia servers themselves are breached.

5-layer ransomware detection

Every file change is scored by five independent detection layers. A composite threat score from 0–100 determines the response — from safe backup to immediate block and alert.

🔢 Layer 1 — Shannon Entropy Analysis

Up to +35 pts

Measures the randomness of a file's byte distribution using Claude Shannon's information entropy formula. Normal documents (PDFs, Word files, source code) typically score 3–6 bits/byte. Ransomware-encrypted content scores 7.5–8.0 — near maximum entropy — because good encryption makes output indistinguishable from random noise. Any file above 7.5 bits/byte earns maximum entropy points.

H = -Σ p(x) log₂ p(x) · threshold: 7.5 bits/byte

🧬 Layer 2 — Magic Byte / MIME Mismatch

Up to +25 pts

Every file format has a unique "magic byte" signature at the start of the file (e.g., PDF files start with %PDF-, ZIP files start with PK). Ransomware often renames encrypted files with innocent extensions (.pdf, .docx) while the actual content is encrypted binary. Vault reads the first 8–16 bytes of every changed file and flags mismatches between the real content type and the declared extension.

libmagic + IANA MIME registry · first 16 bytes inspected

🚫 Layer 3 — Ransomware Extension Blocklist

Up to +30 pts

A curated blocklist of 18 known ransomware file extensions maintained by Grovia's threat intelligence team. Any file renamed to a blocked extension triggers an immediate high-score flag regardless of other layers. The list is updated with each agent release.

.locked.encrypted.crypted .enc.crypto.vault .cerber.locky.wannacry .petya.zepto.thor .aesir.zzzzz.osiris .micro.ttt.lnk

📝 Layer 4 — Ransom Note Pattern Matching

Up to +40 pts

Every ransomware strain leaves instructions for the victim — a text file with payment instructions. Vault watches for file creation events matching a regex of known ransom note filename patterns. A match here is the strongest single indicator of an active ransomware attack and scores maximum points, triggering an immediate block-and-alert response.

README*.txtDECRYPT* RECOVER*HOW_TO* ATTENTION*YOUR_FILES*

📈 Layer 5 — Change Velocity Monitoring

+20 pts per doubling above 10× baseline

This layer catches novel ransomware that doesn't match any known signature. Ransomware encrypts files at machine speed — hundreds or thousands of files per minute. Grovia Vault tracks each endpoint's file-change rate using a rolling 7-day average baseline. When the observed velocity exceeds 10× the baseline, the engine adds velocity points proportional to how far above the threshold the rate is. This is the most robust detection method because it requires no prior knowledge of the specific ransomware strain — behavior-based detection always catches new variants.

rolling 7-day baseline · EMA smoothing · 10× multiplier threshold

Threat Score Zones

The composite score from all five layers determines the automated response.

Live threat score meter — animated on page load

0
0–29 SAFE — backup proceeds 30–59 WATCH — logged & monitored 60–79 ALERT — email + webhook fired 80–100 BLOCK — backup paused immediately

Eight layers of platform security

Beyond ransomware detection, every component of the Grovia Vault platform is hardened against attack.

🔐

AES-256-GCM

Military-grade authenticated encryption. Every chunk encrypted client-side. GCM mode verifies integrity on decryption — any tampering is caught.

🔑

JWT + TOTP MFA

HS256 JSON Web Tokens with 24-hour expiry for API auth. TOTP-based multi-factor authentication enforced on all account access.

🏢

Row-Level Security

PostgreSQL RLS policies enforce tenant isolation at the database layer. No query can access another tenant's data — not even an application bug.

🔗

Presigned URLs

Agents upload via short-lived presigned PUT URLs (15-min expiry). Storage credentials never exist on agent devices — eliminating credential theft as an attack vector.

⚖️

DPDP Act 2023

Compliant with India's Digital Personal Data Protection Act 2023. Data residency options in Mumbai (ap-south-1). Audit logs available for regulator requests.

Redis Sessions

Server-side session store in Redis enables instant session revocation. Log out all devices, revoke compromised tokens, or enforce MFA re-enrollment centrally.

🧊

Immutable Backups

B2 and S3 Object Lock (WORM mode) prevents backup deletion or modification for the configured retention period — even by a compromised admin account.

📋

Audit Trail

Tamper-evident log of every backup run, restore action, policy change, and login event. Immutable audit records satisfy RBI, SEBI, and DPDP compliance requirements.

Zero-Knowledge Architecture

The server never sees your data

Zero-knowledge means exactly what it says: even if Grovia's servers are compromised, your data remains encrypted and unreadable. Here's how the key derivation works.

  • Your backup passphrase is entered once during agent setup
  • The passphrase is hashed locally using SHA-256 to derive a 32-byte key
  • The passphrase and derived key never leave your device
  • Data is encrypted before the first byte is transmitted
  • Grovia servers only ever receive and store opaque ciphertext
  • Even Grovia engineers cannot decrypt your backups
  • If you forget your passphrase, your data cannot be recovered — choose wisely
What if Grovia is breached? An attacker who gains full access to Grovia's servers would find only AES-256-GCM ciphertext and the metadata needed to organise it. Without your passphrase, the data is computationally infeasible to decrypt — even with nation-state computing resources.

Key Derivation Flow

This all happens locally on your device, before any network call is made.

# 1. User sets passphrase (once, during setup) passphrase = "my-secure-backup-phrase-2025" # 2. Key derivation — LOCAL, never transmitted import hashlib key = hashlib.sha256( passphrase.encode('utf-8') ).digest() # → 32 bytes (256 bits) # 3. Per-chunk encryption — LOCAL import os from Crypto.Cipher import AES nonce = os.urandom(12) # 96-bit nonce cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) ctext, tag = cipher.encrypt_and_digest(plaintext) # 4. What gets uploaded to Grovia servers: upload_blob = nonce + tag + ctext # ← 100% opaque # The server stores upload_blob. # Without the passphrase, it is unreadable. # Grovia has no copy of your passphrase or key.
Security-first backup

Start with zero-knowledge protection today

Free plan includes full AES-256-GCM encryption and the complete 5-layer ransomware detection engine. No credit card required.