Help Security and data
Client-side encryption
On this page
Purpose
This guide explains how PhishTrainer protects your employees' personal data through client-side encryption. The information (last name, first name, email address…) is encrypted and decrypted only in the user's browser. On our servers, it stays unreadable, including to us.
In short: our servers only store and transmit encrypted data. Neither the passphrase nor the data key is ever sent to us: Bexxo has no technical means of reading your data.
An option enabled per organisation
Client-side encryption is enabled organisation by organisation. Bexxo prepares the activation, but cannot complete it: an administrator of your organisation does so, in their browser. At that point, they create the data key, choose their passphrase, set the one for the sending agent and receive a recovery code.
None of these values leaves their browser in plain text. An organisation that does not enable the option keeps working as before: its data remains protected by our usual security measures, without client-side encryption.
Four things to know
| Element | Role |
|---|---|
| Password | Proves the user's identity to the server. It grants access to the account, not to the content of the data. |
| Passphrase | Opens the vault. Each person has their own, known only to them, which never leaves their computer. |
| Data key | Only one per organisation. It is the key that encrypts and decrypts the information. Each authorised person has a copy of it, stored in their own vault. |
| Recovery code | Issued only once, at activation. It opens a backup vault if no passphrase is available any more. Keep it offline, in a safe place. |
Who holds a key
The data key is never stored as is. Our servers keep several copies of this key, each one sealed in a different vault and locked by a secret we do not know. Removing a person's access means deleting their vault, without touching the others.
Encrypts and decrypts your employees' information.
What our servers keep: locked vaults
-
Each administrator Locked by their passphrase
-
Each authorised employee Locked by their passphrase
-
The sending agent installed on your premises Locked by the agent's passphrase
-
The backup vault Locked by the recovery code, kept offline by your organisation
How it works, in five steps
Each step is shown as a diagram: on the left, what happens on the user's computer (web browser); on the right, on the PhishTrainer server; in the middle, what is sent between the two.
Step 1: sign-in
The user signs in to PhishTrainer from their browser and confirms.
| Username | m.dupont |
| Password | •••••••••• |
The server validates the authentication. The password grants access to the account, not to the content of the data.
Step 2: vault delivery
The browser receives the vault, still locked. The data key is sealed inside.
The server stores the encrypted vault and sends it as is. It has no means of opening it.
| Vault | 7Hq#9xLm2v!Rk0Pz… |
Step 3: unlocking on the computer
The user enters their passphrase. The browser uses it to open the vault and retrieve the data key.
| Passphrase | •••••••••••••• |
| Data key | ✓ available |
The server receives neither the passphrase nor the data key, so it cannot open the vault.
Step 4: viewing the data
The data key makes the information readable, only on the user's screen.
| First name | Marie |
| Last name | Dupont |
| marie.dupont@example.ch |
The information is stored and transmitted in encrypted form only.
| First name | q8Zr!0aPw3… |
| Last name | Xv2$kLm9Qe… |
| Tb7#hN1sYc… |
Step 5: editing a value
The user corrects a first name. Before anything is sent, the new value is re-encrypted with the data key.
| New value | Marie-Claire |
| Value sent | Lk2#vR9pXa… |
The server replaces the old value with the new one, without ever being able to read it.
Granting and restoring access
Granting access to an employee
- An administrator whose vault is open grants access to the person. Their browser creates a vault for that person, locked by a temporary passphrase.
- The administrator gives this temporary passphrase to the person, through a channel other than PhishTrainer.
- When they first sign in, the person opens their vault with the temporary passphrase, then chooses their own passphrase. The temporary passphrase then stops working.
In an encrypted organisation, a person without a vault cannot sign in to the organisation's space.
Forgotten passphrase
Bexxo cannot send you a passphrase again: we do not know it. An administrator gives the person access again, as for a new employee; other people are not affected. If no administrator can open their vault any more, the recovery code lets you regain control.
Keep the recovery code in a safe place. If all the passphrases and the recovery code are lost, your organisation's encrypted data becomes permanently unreadable. Nobody, not even Bexxo, can recover it.
What is encrypted, what remains readable
| Data | On our servers |
|---|---|
| Employees' last name, first name and email address | Encrypted: unreadable to us |
| Group names | Encrypted: unreadable to us |
| Emails reported by your employees | Analysed on arrival, then sealed: only your organisation can reopen them |
| Email address used to sign in | Replaced by a hash calculated in the browser, from which the address cannot be recovered |
| Organisation name and address | Readable: needed for the contract and invoicing |
Who sees what
At any time, the same information exists in two forms: encrypted on our servers, readable only in the user's browser.
| Data | Us, on our servers | The user, in their browser |
|---|---|---|
| First name | Lk2#vR9pXa0dM… | Marie-Claire |
| Last name | Xv2$kLm9Qe4tB… | Dupont |
| Tb7#hN1sYc8wR… | marie.dupont@example.ch | |
| Vault | locked | opened locally |
Sending emails
Since our servers no longer know your employees' addresses, they cannot write to them. In an encrypted organisation, all emails (simulations, invitations, notifications) are sent from the sending agent installed in your environment. The agent has its own vault: it opens the data key, completes each email with the recipient's address and name, then sends it.
Signing in to PhishTrainer does not depend on the agent. Only two-step verification by email needs it.
What this changes for you
- Support: our team does not see your employees. If you need help with your data, you can grant it temporary access from your space.
- Search: our servers can neither search nor sort your employees by name, since they cannot read these names.
- Responsibility: the security of the passphrases and of the recovery code rests with your organisation.
Key points
- Data we cannot read: everything we store and transmit is encrypted.
- A doubly protected key: the data key is sealed in an encrypted vault that only the passphrase can open.
- No access on our side: neither the passphrases, nor the recovery code, nor the key are sent to us; we cannot decrypt your data.
- One access per person: each authorised employee has their own vault, which can be removed without touching the others.
The values shown on this page (names, addresses, encrypted values) are examples.
Didn’t find the answer? Contact us