Client engagements separated by encryption, not by folder names.
You work across multiple clients simultaneously. A breach, a careless share, or a legal process that crosses the engagement boundary is an existential event. Koaich enforces that boundary at the cryptography layer — not by folder convention, not by policy.
What you get
Per-engagement vault isolation
Each client engagement has its own encryption boundary. There is no shared key across clients — by design. A credential leak, a bad actor, or legal process aimed at one engagement cannot reach another.
Encrypted deliverable storage
Strategy docs, research, models, and working drafts — each file encrypted with its own key, wrapped to each authorized team member. Competitor intelligence from a diligence engagement stays where it belongs.
Secure deliverable delivery to clients
Send a final deck, report, or sensitive file to a client who doesn't use Koaich. They receive a metadata-only email; the file decrypts on their device. Your deliverable never sits in cleartext on any third-party cloud storage in transit.
Group collaboration with automatic key rotation
When a subcontractor or analyst rolls off an engagement, encryption keys rotate automatically. They can no longer read this month's strategy thread — even if they still hold old credentials.
AI drafting on your private engagement corpus
Drafting agents work against your engagement vault's content only. Note: AI features run outside Koaich's zero-knowledge boundary — prompts are processed by a third-party model provider and are not end-to-end encrypted.
The underlying cryptography
Every claim above is grounded in a specific primitive. Not marketing.
- →Per-engagement symmetric vault keys wrapped to each authorized team member — no shared key across client engagements
- →X25519 + ML-KEM-1024 (NIST FIPS 203) hybrid key agreement for 1:1 threads
- →Sender-Key group messaging with automatic key rotation on member removal — for engagement teams
- →Per-file symmetric keys wrapped to each authorized recipient — file access is per-person, not per-folder
- →WebAuthn passkeys for authentication — the key never leaves your authenticator
Get on the waitlist.
We're onboarding independent & boutique consulting first. Read the architecture if you want detail.