Privacy & security
Local encryption
How DeepJournal encrypts the journal database on your device and what protection it provides while the journal is locked.
DeepJournal encrypts the journal database stored on your device. This local protection is separate from end-to-end encrypted sync, which protects configured sensitive fields when they are synchronized.
Encrypted local database
The desktop application stores its journal in a local SQLite database. That database is encrypted at rest using SQLeet.
The local database key is derived from the user's data-encryption key (DEK). It is not the user's password and is not the same subkey used for field encryption during sync.
When the journal is locked
When the journal is locked, DeepJournal closes the database and wipes the plaintext DEK from application memory. This protects a copied database file, but it cannot protect plaintext displayed or processed on an already unlocked, compromised device.
Security boundary
Local encryption protects a copy of the journal database while it is locked. It does not protect an already unlocked device.