nhost

A small key service for encrypting personal data field by field, as serverless functions on Nhost. A caller signed in with an Nhost JWT asks for the public key of one field of its record, and the function derives a deterministic X25519 key for that tenant, user, field and version from one master seed with HKDF-SHA256. The client encrypts with an ephemeral key, ECDH and AES-256-GCM, and a second function re-derives the private key to decrypt. No per-field key is ever stored. A two-day prototype from November 2025.