End-to-end encrypted
real-time collaboration SDK.

Why ZeroSync

Zero-knowledge by architecture, not by promise.

• Architecture supports regulated workflows

  HIPAA technical safeguards, attorney-client privilege, GDPR data-minimization by design. Not certified — architecture enables your own compliance program.

• Self-hosted

  Run on your own Hetzner / AWS / bare metal via one Docker image. No vendor-cloud dependency. Server is Apache 2.0 — fully open-source, no license fees for self-hosting.

• Open-source client, auditable crypto

  MIT-licensed client SDK. Web Crypto API only — no third-party crypto libraries. Property-based tests via fast-check. SLSA provenance on every release.

• Real React hooks

  Companion package @tovsa7/zerosync-react — useYText, usePresence, useMyPresence, useConnectionStatus. Works with Tiptap, CodeMirror, Quill via standard Yjs bindings.

Use cases

Products where two or more humans collaborate on sensitive content — and "your server cannot read it" is itself a feature.

Quick start

Spin up your own signaling server, then integrate the SDK. 30 lines total.

docker run -p 8080:8080 ghcr.io/tovsa7/zerosync-server:latest

npm install @tovsa7/zerosync-react @tovsa7/zerosync-client react yjs

import { ZeroSyncProvider, useYText, useConnectionStatus } from '@tovsa7/zerosync-react'
import { deriveRoomKey } from '@tovsa7/zerosync-client'

function App({ roomKey }: { roomKey: CryptoKey }) {
  return (
    <ZeroSyncProvider
      serverUrl="wss://sync.example.com/ws"
      roomId="my-room"
      roomKey={roomKey}
      peerId={crypto.randomUUID()}
      nonce={btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))))}
      hmac=""
      iceServers={[{ urls: 'stun:stun.l.google.com:19302' }]}
    >
      <Editor />
    </ZeroSyncProvider>
  )
}

function Editor() {
  const status = useConnectionStatus()
  const text   = useYText('editor')
  if (status !== 'connected') return <p>Status: {status}</p>
  return (
    <textarea
      value={text?.toString() ?? ''}
      onChange={(e) => {
        text?.delete(0, text.length)
        text?.insert(0, e.target.value)
      }}
    />
  )
}

npm install @tovsa7/zerosync-client yjs

import { Room, deriveRoomKey } from '@tovsa7/zerosync-client'

// Room key is derived client-side and never transmitted.
const secret  = crypto.getRandomValues(new Uint8Array(32))
const roomKey = await deriveRoomKey(secret, 'my-room-id')

const room = await Room.join({
  serverUrl:  'wss://your-server/ws',
  roomId:     'my-room-id',
  roomKey,
  peerId:     crypto.randomUUID(),
  nonce:      btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16)))),
  hmac:       '',
  iceServers: [{ urls: 'stun:stun.l.google.com:19302' }],
})

const text = room.getDoc().getText('editor')
text.observe(() => console.log(text.toString()))

room.updatePresence({ name: 'Alice' })
room.leave()

See the React hooks package for useYMap, useYArray, usePresence, and Tiptap / CodeMirror integration examples.

How it compares

Versus the most common alternatives for real-time collaboration.

• Direct founder access

  Email goes straight to me — no support tiers, no tickets. You talk to the person who writes the code.

• Priority on the roadmap

  Your use case shapes the next quarter. Needed features jump the queue — you see what ships because of you.

• Grandfathered pricing

  Today's rate stays locked in as standard prices rise. No surprise hikes when you scale your deployment.

• Hands-on deployment

  Pair-programming for self-hosted setup. TOM compliance template. We debug your NAT or WebRTC issues together.