Secure Team Handoff: XChaCha20-Poly1305
Zero-Knowledge Collaboration for Enterprise Teams
AI Summary / Key Takeaways
"Collaborate on sanitized documents without compromising zero-trust architecture. Export your active RAM session map, encrypt it locally using military-grade XChaCha20-Poly1305 and an Argon2id derived key, and share it with a teammate so they can reveal the text on their end. Available in the Site Workspace."
Enterprise-Grade AI Privacy
Add custom redaction rules and priority support with PRO.
The Hidden Cost of AI Collaboration Without Zero-Trust
Your analyst masks a contract before sending it to ChatGPT — but when the AI response lands, the reviewer on the other side of the company sees tokens like [NAME_1] and [COMPANY_3]. They have no session map. They cannot read the answer. The fix most teams reach for — a shared cloud account or a central database — immediately violates zero-trust principles and fails SOC2 CC6.1 and HIPAA §164.312(e). There is no middle ground. Until now.
How Secure Team Handoff Works
Local Key Generation
Your browser derives a highly secure cryptographic key from your team's shared passphrase using Argon2id, the industry standard for memory-hard key derivation.
Client-Side Encryption
The entire PII session map (which ties tokens like [NAME_1] to real values) is encrypted locally using the XChaCha20-Poly1305 cipher before leaving your device.
Encrypted Transfer
The resulting ciphertext is exported as a portable string. Even if intercepted, it remains mathematically impossible to decrypt without the local passphrase.
What Teams Achieve with Local PII Masking
Swipe to read more
Supported Formats & Limitations
Supported Formats
System Limitations
- Requires pre-shared encryption passwords for handoff decryption
- Sessions expire implicitly based on team protocol (not enforced by a server)
- Cannot be recovered if the handoff password is lost
The Real Problem with AI Collaboration in Regulated Teams
Consider three real workflows that break down the moment compliance enters the picture:
- Legal: A paralegal scrubs a contract containing client names before running it through Claude. The reviewing partner receives the AI summary — full of
[NAME_1]and[COMPANY_2]tokens. She cannot read it without the session map, which is locked inside the paralegal's browser RAM. - Healthcare: A billing analyst masks PHI in a patient record before querying ChatGPT for ICD-10 code suggestions. The attending physician needs to review the AI recommendation in context — but the token map is gone the moment the analyst closes the tab.
- Finance: An M&A analyst scrubs deal terms for an AI-driven valuation model. The CFO receives the model output annotated with placeholder tokens. Re-inserting the real figures manually takes 20 minutes per document. Multiply by 15 deals in the pipeline.
The instinct is to fix this by storing the session map in a shared database or a synced cloud folder. But that immediately violates HIPAA §164.312(e), SOC2 CC6.1, and GDPR Article 25 (Privacy by Design). You cannot have both collaboration and zero-trust if a server holds the keys. Secure Team Handoff solves this without the tradeoff.
Cryptographic Parity: Argon2id + XChaCha20-Poly1305
Instead of trusting our servers to hold your keys, we empower your browser to act as a secure enclave. Your team's shared passphrase is run through Argon2id — the winner of the Password Hashing Competition and the NIST SP 800-132 recommended algorithm — to derive a robust encryption key. The volatile session map is then encrypted using XChaCha20-Poly1305, an AEAD cipher that provides both confidentiality and authentication in a single pass.
The Trust Architecture: No Cloud in the Loop
The diagram below shows what actually happens during a Team Handoff. Every node where PII could leak has been eliminated by design.
locally in browser
Zero PII
Reveal in browser
Compliance-Ready by Design
Team Handoff was built to pass compliance reviews, not just security ones. Here is how it maps to the major frameworks your legal and audit teams care about:
| Framework | Control | How Team Handoff Satisfies It |
|---|---|---|
| HIPAA | §164.312(e) — Encryption in transit | PHI session map is encrypted (XChaCha20-Poly1305) before leaving the device. Network only sees ciphertext. |
| SOC2 | CC6.1 + CC6.7 — Logical access & transmission encryption | No centralized credential store. Key derivation uses Argon2id. Zero server receives plaintext PII. |
| GDPR | Art. 25 — Privacy by Design & Default | Data minimization is architectural: no PII is processed server-side at any point in the handoff chain. |
| ISO 27001 | A.8.24 — Use of cryptography | Uses AEAD with authenticated tag. Key length and algorithm (XChaCha20) exceed A.8.24 minimum cryptographic control requirements. |
| NIST | SP 800-132 — Password-based key derivation | Argon2id with configurable memory, iterations, and parallelism parameters — compliant with NIST recommendations for password hashing. |
Team Handoff vs. Shared Cloud Accounts
Most teams working around the token-isolation problem reach for one of three workarounds — all of which fail a compliance audit:
| Method | Server Access to PII? | HIPAA Safe? | Setup Time |
|---|---|---|---|
| Team Handoff (PrivacyScrubber) | Never | Yes | 30 seconds |
| Shared Google Doc with token map | Google sees it | No | 5 minutes |
| Shared Notion / Confluence database | Notion sees it | No | 10 minutes |
| Manual re-insertion (copy-paste) | Depends on method | Conditional | 15–25 min/doc |
Workflows by Industry
Legal Teams
Paralegals scrub client names and entity identifiers from contracts before running them through AI drafting tools. The reviewing partner imports the encrypted payload and uses Reveal to read the final clause in context — without client data ever touching a third-party server.
Healthcare
Billing teams mask PHI — patient names, DOBs, MRNs — before querying AI for ICD-10 suggestions. The attending physician imports the session payload to review recommendations mapped back to actual patients. Full HIPAA §164.312(e) compliance throughout.
Finance & M&A
Deal analysts mask company names and financial figures before feeding them into AI valuation models. The CFO or managing director imports the encrypted session to review the AI output with real deal terms restored — in seconds, not 20-minute manual re-insertions.
Flat Pricing. No Per-Seat Surprises.
Secure Team Handoff is included in the TEAMS plan at $99/month flat — no per-seat pricing, no usage caps on handoff payloads. Whether your team is 3 people or 300, the price does not change. This is a deliberate architectural choice: because everything runs in the browser, we have zero marginal cost per user, and we pass that directly to you.
For organizations requiring on-premise deployment, air-gapped operation, or a source code license, the ENTERPRISE plan includes all Team Handoff capabilities with GRC support and a dedicated compliance review package.
Feature Reliability & Audit
This enterprise feature is powered by our Local-First Sanitization Engine. Unlike legacy cloud DLP tools, PrivacyScrubber processes your Secure Team Handoff: XChaCha20-Poly1305 logic 100% within your browser's V8 sandbox. This architectural decision ensures that even the most complex detection patterns never expose raw data to an external API.
Airplane Mode
Verified feature operational integrity without network connectivity.
Step-by-Step Guide
How to use this feature
Scrub Document
Scrub any document containing PII in PrivacyScrubber as usual.
Generate Ciphertext
Click 'Export Team Session'. Your browser will encrypt the session map using your team's shared passphrase and output a cryptographic payload.
Share Securely
Send the encrypted payload to your colleague via Slack, Teams, or email alongside the scrubbed AI response.
Import & Reveal
Your colleague clicks 'Import Team Session', pastes the payload, and enters the shared passphrase to reconstruct the session map locally.
Frequently Asked Questions
What encryption algorithms does Team Handoff use?
Team Handoff relies on Argon2id for password hashing and key derivation, combined with XChaCha20-Poly1305 for authenticated encryption. These modern cryptographic primitives provide robust protection against side-channel and timing attacks, entirely within your browser.
Does the encrypted session map ever touch your servers?
No. We provide the cryptographic engine, but the encryption happens on your local CPU. The resulting ciphertext is handled entirely by you — you can paste it into an email, Slack, or internal wiki. We never see the data, the key, or the ciphertext.
What happens if someone intercepts the handoff payload?
The payload is protected by XChaCha20-Poly1305 encryption. Without the shared team passphrase (used by Argon2id to derive the decryption key), the payload is indistinguishable from random noise and mathematically impossible to decrypt.
Is Team Handoff available on the Free or PRO tier?
No. Secure Team Handoff is an exclusive feature of the TEAMS and ENTERPRISE tiers, designed specifically for multi-user collaborative workflows and organizational compliance.
Does Team Handoff satisfy HIPAA and SOC2 requirements?
Yes. Because the PII session map is encrypted client-side before any transfer, no Protected Health Information (PHI) traverses the network in plaintext. This satisfies HIPAA §164.312(e)(1) for encryption in transit and supports SOC2 CC6.1 (logical access) and CC6.7 (data transmission encryption). The Argon2id key derivation also meets NIST SP 800-132 recommendations for password-based key derivation.
How many team members can use Team Handoff simultaneously?
TEAMS plan is priced at $99/month flat with no per-seat limits. All team members can export and import encrypted session payloads. There is no hard limit on the number of simultaneous users.
What if we lose the team passphrase?
The passphrase is never stored anywhere — not on our servers, not in your browser. If it is lost, the encrypted payload cannot be recovered. We recommend storing the passphrase in a team password manager (1Password, Bitwarden, or your enterprise vault) under a shared vault entry.
Protect Your Team's AI Prompts in Under 30 Seconds
Protect My TeamNo server uploads. Works 100% offline in browser RAM.
