Secure Team Handoff: XChaCha20-Poly1305
Zero-Knowledge Collaboration for Enterprise Teams
AI Summary / Key Takeaways
"Collaborate on sanitized documents without compromising zero-trust architecture. Export your active RAM session map, encrypt it locally using military-grade XChaCha20-Poly1305 and an Argon2id derived key, and share it with a teammate so they can reveal the text on their end. Available in the Site Workspace."
Enterprise-Grade AI Privacy
Add custom redaction rules and priority support with PRO.
Interactive PII Detection & Sanitization Sandbox
Test real-time client-side RAM tokenization. Choose a specialized preset or paste your own raw prompt to test instant reversible redaction.
The Hidden Cost of AI Collaboration Without Zero-Trust
Your analyst masks a contract before sending it to ChatGPT — but when the AI response lands, the reviewer on the other side of the company sees tokens like [NAME_1] and [COMPANY_3]. They have no session map. They cannot read the answer. The fix most teams reach for — a shared cloud account or a central database — immediately violates zero-trust principles and fails SOC2 CC6.1 and HIPAA §164.312(e). There is no middle ground. Until now.
How Secure Team Handoff Works
Local Key Generation
Your browser derives a highly secure cryptographic key from your team's shared passphrase using Argon2id, the industry standard for memory-hard key derivation.
Client-Side Encryption
The entire PII session map (which ties tokens like [NAME_1] to real values) is encrypted locally using the XChaCha20-Poly1305 cipher before leaving your device.
Encrypted Transfer
The resulting ciphertext is exported as a portable string. Even if intercepted, it remains mathematically impossible to decrypt without the local passphrase.
What Teams Achieve with Local PII Masking
Swipe to read verified reviews
Supported Formats & Limitations
Supported Formats
System Limitations
- Requires pre-shared encryption passwords for handoff decryption
- Sessions expire implicitly based on team protocol (not enforced by a server)
- Cannot be recovered if the handoff password is lost
The Real Problem with AI Collaboration in Regulated Teams
Consider three real workflows that break down the moment compliance enters the picture:
- Legal: A paralegal scrubs a contract containing client names before running it through Claude. The reviewing partner receives the AI summary — full of
[NAME_1]and[COMPANY_2]tokens. She cannot read it without the session map, which is locked inside the paralegal's browser RAM. - Healthcare: A billing analyst masks PHI in a patient record before querying ChatGPT for ICD-10 code suggestions. The attending physician needs to review the AI recommendation in context — but the token map is gone the moment the analyst closes the tab.
- Finance: An M&A analyst scrubs deal terms for an AI-driven valuation model. The CFO receives the model output annotated with placeholder tokens. Re-inserting the real figures manually takes 20 minutes per document. Multiply by 15 deals in the pipeline.
The instinct is to fix this by storing the session map in a shared database or a synced cloud folder. But that immediately violates HIPAA §164.312(e), SOC2 CC6.1, and GDPR Article 25 (Privacy by Design). You cannot have both collaboration and zero-trust if a server holds the keys. Secure Team Handoff solves this without the tradeoff.
Cryptographic Parity: Argon2id + XChaCha20-Poly1305
Instead of trusting our servers to hold your keys, we enable your browser to act as a secure enclave. Your team's shared passphrase is run through Argon2id — the winner of the Password Hashing Competition and the NIST SP 800-132 recommended algorithm — to derive an authenticated encryption key. The volatile session map is then encrypted using XChaCha20-Poly1305, an AEAD cipher that provides both confidentiality and authentication in a single pass.
The Trust Architecture: No Cloud in the Loop
The diagram below shows what actually happens during a Team Handoff. Every node where PII could leak has been eliminated by design.
locally in browser
Zero PII
Reveal in browser
Compliance-Ready by Design
Team Handoff was built to pass compliance reviews, not just security ones. Here is how it maps to the major frameworks your legal and audit teams care about:
| Framework | Control | How Team Handoff Satisfies It |
|---|---|---|
| HIPAA | §164.312(e) — Encryption in transit | PHI session map is encrypted (XChaCha20-Poly1305) before leaving the device. Network only sees ciphertext. |
| SOC2 | CC6.1 + CC6.7 — Logical access & transmission encryption | No centralized credential store. Key derivation uses Argon2id. Zero server receives plaintext PII. |
| GDPR | Art. 25 — Privacy by Design & Default | Data minimization is architectural: no PII is processed server-side at any point in the handoff chain. |
| ISO 27001 | A.8.24 — Use of cryptography | Uses AEAD with authenticated tag. Key length and algorithm (XChaCha20) exceed A.8.24 minimum cryptographic control requirements. |
| NIST | SP 800-132 — Password-based key derivation | Argon2id with configurable memory, iterations, and parallelism parameters — compliant with NIST recommendations for password hashing. |
Team Handoff vs. Shared Cloud Accounts
Most teams working around the token-isolation problem reach for one of three workarounds — all of which fail a compliance audit:
| Method | Server Access to PII? | HIPAA Safe? | Setup Time |
|---|---|---|---|
| Team Handoff (PrivacyScrubber) | Never | Yes | 30 seconds |
| Shared Google Doc with token map | Google sees it | No | 5 minutes |
| Shared Notion / Confluence database | Notion sees it | No | 10 minutes |
| Manual re-insertion (copy-paste) | Depends on method | Conditional | 15–25 min/doc |
Workflows by Industry
Legal Teams
Paralegals scrub client names and entity identifiers from contracts before running them through AI drafting tools. The reviewing partner imports the encrypted payload and uses Reveal to read the final clause in context — without client data ever touching a third-party server.
Healthcare
Billing teams mask PHI — patient names, DOBs, MRNs — before querying AI for ICD-10 suggestions. The attending physician imports the session payload to review recommendations mapped back to actual patients. Full HIPAA §164.312(e) compliance throughout.
Finance & M&A
Deal analysts mask company names and financial figures before feeding them into AI valuation models. The CFO or managing director imports the encrypted session to review the AI output with real deal terms restored — in seconds, not 20-minute manual re-insertions.
Zero-Server Fleet Blueprints & 1-Click CISO Receipts
Beyond collaborative session handoff, the TEAMS tier equips CISOs with instant, zero-infrastructure fleet governance:
Export an AES-GCM encrypted Blueprint token or JSON package to deploy unified PII policies, strictness enforcement modes, and locked corporate regex rules across 10,000+ browser seats with zero server configuration or proxy latency.
Generate client-side verifiable PDF compliance certificates featuring SHA-256 session telemetry hashes, UTC timestamps, and cryptographic proof of 0 bytes network egress for SOC 2, HIPAA, and cyber insurance audits.
Flat Pricing. No Per-Seat Surprises.
Secure Team Handoff is included in the TEAMS plan at $99/month flat — no per-seat pricing, no usage caps on handoff payloads. Whether your team is 3 people or 300, the price does not change. This is a deliberate architectural choice: because everything runs in the browser, we have zero marginal cost per user, and we pass that directly to you.
For organizations requiring on-premise deployment, air-gapped operation, or a source code license, the ENTERPRISE plan includes all Team Handoff capabilities with GRC support and a dedicated compliance review package.
Client-Side Reliability & Audit Verification
Powered by the Zero-Trust Sanitization Engine (ZTDS). All detection, tokenization, and regex evaluation execute 100% inside your local client process boundary — eliminating cloud proxies, intermediate servers, and third-party data retention risks.
Step-by-Step Guide
How to use this feature
Scrub Document
Scrub any document containing PII in PrivacyScrubber as usual.
Generate Ciphertext
Click 'Export Team Session'. Your browser will encrypt the session map using your team's shared passphrase and output a cryptographic payload.
Share Securely
Send the encrypted payload to your colleague via Slack, Teams, or email alongside the scrubbed AI response.
Import & Reveal
Your colleague clicks 'Import Team Session', pastes the payload, and enters the shared passphrase to reconstruct the session map locally.
Frequently Asked Questions
Technical Details & Privacy Architecture
What encryption algorithms does Team Handoff use?
Does the encrypted session map ever touch your servers?
What happens if someone intercepts the handoff payload?
Is Team Handoff available on the Free or PRO tier?
Does Team Handoff satisfy HIPAA and SOC2 requirements?
How many team members can use Team Handoff simultaneously?
What if we lose the team passphrase?
Protect Your Team's AI Prompts in Under 30 Seconds
No server uploads. No account required. 100% offline in your browser's local RAM.
