Standard Grant: DecVault - Encrypted File Storage and Sharing for Businesses Built on SIA

Project Name

DecVault - Encrypted File Storage and Sharing for Businesses Built on SIA

Organisation or Individual

Hani

Background

DecVault has received two prior Sia Foundation grants and currently has version 1.1.0 live.

The project is also enrolled in Microsoft Founders Hub, with one year of Azure infrastructure credits covered, and part of the Microsoft ISV Success Program.

GitHub: GitHub - r00b00t/SecureSphereApp · GitHub

Previous grant threads: https://forum.sia.tech/t/standard-grant-securesphere-decentralized-vault/935
https://forum.sia.tech/t/small-grants-securesphere-decentralized-password-management-and-breach-monitoring/813/39

Project Description

DecVault is a privacy-first file storage and secure document sharing platform built natively on Sia, designed to generate real, sustained storage usage on the network through everyday workflows.

Files are encrypted on the user’s device and uploaded to the Sia network via the indexd layer, ensuring that neither the indexer nor storage providers ever access plaintext data. DecVault abstracts the complexity of Sia into a simple web, mobile, and Microsoft-integrated experience, allowing non-technical users to store, access, and share files securely without relying on centralized providers.

Users can upload, organize, and share files through a web app and mobile applications (iOS and Android), or directly from Microsoft Word and Excel via an Office add-in. Shared files are accessible through secure links and can be previewed directly in the browser without requiring an account or download.

A key integration is with Microsoft Teams, where meeting recordings and shared files can be routed to Sia-backed storage instead of default cloud providers. Teams recording integration introduces continuous large-file uploads, creating a recurring and scalable source of storage demand on the Sia network.

The backend is built in Python using the official Sia Python SDK for indexd operations, with client-side encryption ensuring that all sensitive data remains under user control at all times.

DecVault builds on prior Sia grant work and an existing deployed application, allowing this phase to focus on scaling real network usage rather than initial experimentation.

Who Benefits

DecVault is designed for anyone who needs to store or share files privately, regardless of technical background.

Individuals and freelancers can share files through secure links without requiring accounts or subscriptions from centralized platforms.

Businesses and enterprises benefit from full control over sensitive data, with encryption keys remaining with the user rather than any service provider.

Microsoft 365 users benefit from optional integrations that allow them to extend their existing workflows to decentralized storage without changing tools.

Recipients can preview files directly in the browser without creating an account, reducing friction and increasing accessibility.

Mission Alignment and Problem Solved

DecVault directly supports the Sia Foundation’s mission of user-owned data by making decentralized storage accessible through practical, high-frequency use cases.

Today, most file storage and sharing workflows rely on centralized providers where users do not control encryption keys and remain dependent on platform policies and infrastructure. DecVault removes this dependency by ensuring that all files are encrypted client-side and stored on a decentralized network where no single party has access or control.

Rather than focusing on low-frequency or experimental use cases, DecVault integrates into real workflows such as file sharing, document storage, and Microsoft 365 usage. In particular, Microsoft Teams recording integration introduces recurring large-file uploads, making DecVault a consistent driver of Sia network utilization.

Microsoft integrations act strictly as optional distribution channels and do not impact core functionality or storage operations. The web and mobile applications remain fully independent and usable without any Microsoft dependency.

By combining usability, encryption, and seamless integration, DecVault enables both individuals and organizations to adopt user-owned data without needing to understand or manage decentralized infrastructure.

Jurisdiction Compliance

Resident of excluded jurisdiction: No

Payment bank account in excluded jurisdiction: No

Grant Specifics

Amount requested: $28,800

Item Detail Total
Developer 6 months × 160 hrs × $30/hr $4800 / Month
Infrastructure Covered by Microsoft Founders Hub Azure credits $0
Marketplace publishing Covered by Microsoft ISV Success Program $0
Total $28,800

This reflects full-time development across backend, mobile, web, and Microsoft integrations.

Grant payments to be received monthly via USD wire transfer.

Architecture Overview

Storage layer: Sia network via indexd SDK. All encryption is performed client-side plaintext never reaches the indexer or storage providers.

Backend: Python (Sia Python SDK), FastAPI, hosted on Azure VM. JWT authentication and optional Azure AD SSO.

Web app: Next.js

Mobile apps: Flutter (iOS and Android)

Office add-in: Office JS API (Word, Excel)

Teams integration: Microsoft Graph API for file handling and recording workflows

All Microsoft integrations are additive and independent from the core system.

Milestones

Month 1

Migrate Flutter mobile app and Python backend to indexd using the official Sia SDK.

Outcome: Fully functional mobile app with verified upload/download on Sia.

Month 2

Web app (phase 1): core file management, upload/download, and basic sharing functionality.

Outcome: Web app functional with core storage and sharing features available.

Month 3

Web app (phase 2): advanced features including file viewer (PDF, images, video, Office documents), secure share links, and Azure AD SSO for enterprise login.

Outcome: Public demo live with full file preview support and authenticated access.

Month 4

Microsoft Teams integration for file transfer and recording routing to Sia.

Outcome: Teams app functional via sideloading, file transfer confirmed, and recording workflow implemented and tested.

Month 5

Microsoft Office add-in (Word, Excel) for saving and opening files from Office applications. Submission to Microsoft AppSource initiated.

Outcome: Add-in functional via sideloading, save/open flows verified, submission completed or under review.

Month 6

Security audit, bug fixes, and performance improvements across all components.

Outcome:

Audit published and all critical issues resolved. Final progress report submitted on forum. Post-grant roadmap published.

Target User

Individuals and freelancers needing private file sharing

Businesses managing sensitive documents

Microsoft 365 users seeking extended storage control

Privacy-focused users adopting decentralized storage

Post-Grant Plans

Revenue through Azure Marketplace subscriptions (Pro and Enterprise tiers).

DecVault will leverage Azure Marketplace and Microsoft Azure Consumption Commitment (MACC), allowing enterprises to procure and deploy the solution using their existing Microsoft budgets, reducing procurement friction and accelerating adoption.

Future roadmap:

SharePoint integration

Expanded Teams compliance features

Enhanced file viewer

Potential Risks

Microsoft review timelines: mitigated by sideloading

Platform dependency: core product fully independent

Scope complexity: core features delivered before integrations

Development Information

Open source: Yes

Repository: GitHub - r00b00t/SecureSphereApp · GitHub

Monthly Progress Reports

Yes will be posted on Sia forum

Contact

Email: [email protected]

Hello @Hani - our team found some other security issues:

  • the full seed seems to be sent to some backend during QR login
  • the renterd URL seems to be constructed with ‘http’ rather than ‘https’
  • your authentication workflow uses a seed derived public key as the password instead of a private key + challenge response
  • insecure stores usage for secrets
  • JWT tokens don’t expire

Before I can look at the proposal, the above will need to be addressed.

1 Like

Hello @mecsbecs ,

Thanks for the detailed review, I really appreciate it.

I want to clarify the current state of the project.

Since the last commit, development has been ongoing with continuous internal audits across security, performance, and UX. This release is part of an ongoing audit cycle covering security, performance, and UX

A new version v1.5 has now been pushed to GitHub:
https://github.com/r00b00t/SecureSphereApp/commit/26d20445518a1c905def9d20f9b140dd7b64fae3

Security & Architecture

Full remediation of all previously reported points:

  • Secure QR pairing (no seed exposure)

  • HTTPS enforced across all endpoints

  • Migration to challenge-response authentication

  • Secure storage hardening (no fallback paths)

  • Expiring and refreshable JWT tokens

Additional security hardening beyond the initial report:

  • AES-GCM encryption with per-file key derivation (HKDF)

  • Removal of plaintext password exposure (k-anonymity model)

  • Secure clipboard handling with automatic clearing after 45 seconds unless overwritten

  • Root, jailbreak, and emulator detection

  • Certificate pinning infrastructure

  • Platform-level hardening for Android and iOS

User-Facing Security Improvements

Screenshots are now blocked:

  • On Android, screenshots, screen recording, and task-switcher previews no longer expose sensitive content

  • On iOS, a privacy overlay is displayed when the app goes to the background

Performance Improvements

  • Reduced cold start time through parallelized and deferred initialization

  • Removed secure storage bottlenecks in password loading

  • Streaming uploads to eliminate memory spikes

  • Fixed download progress stutter near completion

  • Improved desktop responsiveness by removing unnecessary reloads on resume

UX and Product Improvements

  • WCAG-compliant touch targets, tooltips, and keyboard handling improvements

  • Input hardening: disabled autocorrect and suggestions for sensitive fields

  • Improved clipboard UX with safe auto-clear behavior

  • Multi-language support added: English, French, Spanish, German, Italian

  • Automatic language detection on first launch

  • Language can be changed anytime in Settings

This release brings DecVault closer to a production-ready state across security, performance, and usability.

I would appreciate if the proposal can now be reviewed based on the current version.

Thanks again for your feedback.

Hi @Hani - with these changes, the Committee will discuss potential continued interest in DecVault next week, then I’ll be able to let you know if this proposal can be formally reviewed.

Hi @mecsbecs Thanks for the update, I appreciate it.