Introduction to Document Vault
The Hadinet Document Vault is an end-to-end encrypted document storage system that gives individuals full control over their sensitive documents. Built on IPFS for decentralized storage and secured with AES-256-GCM encryption inside Trusted Execution Environments (TEEs), the vault ensures that only you can access your documents -- no one else, not even Hadinet.
Why a Document Vault?
Identity verification generates documents. Passports, national IDs, bank statements, university transcripts, and medical records are all part of the identity ecosystem. Traditional systems store these documents in centralized databases controlled by third parties, creating honeypots for data breaches and leaving users with no sovereignty over their own records.
The Document Vault solves this by placing document storage under the user's cryptographic control. Documents are encrypted before they leave your browser session, stored on IPFS through a private gateway, and can only be decrypted by you through your wallet's cryptographic keys.
Supported Document Types
The vault supports a wide range of document categories relevant to identity and financial verification:
| Category | Examples | Use Cases |
|---|---|---|
| Identity | Passport, National ID, Driver's License, BVN Slip | KYC verification, age proof, citizenship proof |
| Financial | Bank Statements, Tax Returns, Pay Slips, Utility Bills | Income verification, address proof, financial compliance |
| Education | University Transcripts, Diplomas, Certificates | Credential verification, employment screening |
| Legal | Court Orders, Affidavits, Power of Attorney, Contracts | Legal proceedings, authorization proof |
| Medical | Vaccination Records, Medical Reports, Insurance Cards | Healthcare access, travel requirements |
Security Properties
| Property | Implementation | Guarantee |
|---|---|---|
| Encryption at rest | AES-256-GCM with unique key per document | Documents are ciphertext on IPFS; unreadable without your key |
| Key derivation | PBKDF2 with unique salt per document | Keys are derived deterministically from your wallet; never stored |
| Key isolation | TEE-based encryption and decryption | Keys only exist inside the hardware enclave during operations |
| Storage decentralization | IPFS via Pinata private gateway | No single point of failure for file availability |
| On-chain metadata | Cartesi rollup on Arbitrum | Tamper-proof record of document existence and type |
| Access control | Wallet-based authentication | Only the wallet that uploaded a document can decrypt it |
| Deletion | IPFS unpinning + on-chain soft delete | Documents can be made permanently inaccessible |
How It Differs from Cloud Storage
Unlike Google Drive, Dropbox, or iCloud, the Document Vault:
- Never sees your documents in plaintext. Encryption happens inside the TEE before the file reaches IPFS. Hadinet infrastructure cannot read your files.
- Uses your wallet as the key. There are no passwords to forget or reset. Your wallet's cryptographic identity is the key to your vault.
- Stores nothing centrally. Files live on IPFS. Metadata lives on-chain. There is no central database to breach.
- Supports verified and self-attested documents. Documents verified by institutional attestors carry cryptographic proof of their authenticity, while self-uploaded documents are stored with equal security but without third-party attestation.
Architecture at a Glance
User Browser --> TEE Attestor --> [AES-256-GCM Encryption] --> IPFS (Pinata)
|
v
On-chain Metadata (Cartesi Rollup / Arbitrum)
- The user selects a file and document type in the vault interface.
- The file is sent to the TEE attestor over a secure channel.
- Inside the TEE, the attestor derives an encryption key using PBKDF2 with a unique salt.
- The file is encrypted with AES-256-GCM and uploaded to IPFS via the Pinata private gateway.
- The IPFS content identifier (CID), document type, encryption salt, and timestamp are recorded on-chain.
- The encrypted file is retrievable only through the private gateway, and decryptable only inside the TEE with the user's wallet signature.
Next Steps
- How It Works -- Detailed upload and download flows.
- Encryption Model -- Deep dive into AES-256-GCM and PBKDF2 key derivation.
- Storage Architecture -- IPFS, Pinata, and on-chain metadata design.
- Getting Started -- Start using the vault to store your documents.