Three checks before anything opens.
Over the internet, getting to a file means passing all three checks at once. Miss any one and the connection is sealed shut, automatically, with no second try.
A password they know
The right username and password, just like signing in anywhere.
The exact device you trust
Privatta also checks the computer itself. Each machine has its own unique fingerprint, and only the ones you approve get in. A stolen password from a strange laptop is useless.
Permission for that file
Even then, the person only sees the specific files you shared with them. Everything else stays invisible.
All three checks pass
Five protections working together.
Noise Protocol transport
X25519 ephemeral key exchange and ChaCha20-Poly1305 authenticated encryption secure every byte in transit, with forward secrecy per session.
Cryptographic machine identity
Each machine has a persistent Ed25519 keypair (Peer ID over the internet) or is checked by MAC address on the LAN — not just a password.
Automatic ban on failure
A failed P2P handshake permanently bans that peer for the session. There is no second attempt to brute-force.
Trusted network ranges
Pre-authorise VPN address ranges (Tailscale, ZeroTier, RFC 1918 private ranges) so remote teammates connect without weakening the model.
Hashed credentials
Account passwords are stored only as scrypt hashes — never in plaintext, and never written to the access log.
Local, tamper-evident audit log
Every attempt — allowed or denied — is recorded locally with user, machine identity, IP, file and outcome. Nothing is sent to us.
Every knock at the door is written down.
Privatta keeps its own private log of every attempt to reach your files: who, from which device, which file, and whether it was allowed. Passwords never appear in it. And when an unknown device tries its luck, the door seals on the first wrong move.
Bring this to your security review.
The full protocol detail — handshake sequence, identity model, NAT traversal — is documented for procurement and IT architecture teams.