Encrypted relay
For colleagues who aren't on the same network, DeepState syncs through a relay: a small service that stores and forwards encrypted change bundles between devices. The relay is a dumb mailbox. It never has the board key, cannot decrypt anything it holds, and cannot even tell which board a mailbox belongs to.
DeepState runs a relay at relay.getdeepstate.app, included with every license. You can also run
your own; the app accepts any relay URL.
Turning it on
In the board's Collaborate dialog, under Encrypted relay, the URL field is pre-filled with DeepState's relay. Click Connect. The status line shows Connecting… then Connected · synced just now. Do the same on each device, with the same URL. Everyone else joins with Join shared board… → Relay and the same URL.
Once connected the dialog offers:
- Pause / Resume - stop exchanging without forgetting anything.
- Push full history - re-publish everything this device knows about the board to the relay. Use it to seed a new relay, or after the relay has expired old history (below).
- Change… - switch to a different relay URL.
- Remove - stop using the relay for this board.
How it works
- The board key is hashed to produce a room ID. Devices with the same key derive the same room; nobody else can guess it, and the relay cannot link a room to a board name, a license or a person.
- Each device keeps a WebSocket open to its rooms. Local changes are encrypted with the board key (the room ID is bound into the encryption so a frame can't be replayed into another room) and published; the relay assigns a sequence number and fans the frame out to every connected device, which decrypts and applies it.
- Devices that were offline read forward from the last sequence number they saw when they reconnect. The relay keeps frames for 90 days.
- Media files are encrypted, named by a hash, and stored in the relay's blob store; devices upload what they have and download what they lack. File names travel inside the ciphertext. The hosted relay keeps media for 7 days (see below).
- Every device publishes its own edits. When you first connect a board that already has history, DeepState also publishes the full history once so that newcomers can rebuild it.
Retention and re-seeding
The relay is a mailbox, not a backup: every device keeps the full board locally, and the relay only has to hold things long enough for your other devices to pick them up.
| Kept on the hosted relay | |
|---|---|
| Changes (frames) | 90 days |
| Media files (images, documents, attachments) | 7 days after upload |
Changes. If a device has been away for more than 90 days, the relay tells it so and the Collaborate dialog shows: The relay no longer holds the early history of this board. Any up-to-date device can fix this by clicking Push full history, which republishes the complete board. The stale device then catches up.
Media. Each time a device connects to the relay, it checks which of the board's media files the relay still has and re-uploads any that expired. Files are only lost from the relay while no device holding them has connected for 7 days. If a colleague's board shows missing images after a long break, have anyone who has them open the board, or click Push full history, which also re-uploads media. Nothing is deleted from any device; this only affects what the relay is holding at the moment.
Self-hosting
The relay is open source: github.com/DeepState-Inc/deepstate-relay.
It is a Cloudflare Worker with a Durable Object per room and an R2 bucket for blobs, deploys with
wrangler deploy to any Cloudflare account, and fits in the free tier for a small team. Then
enter your relay's URL (for example https://relay.example.com) in the Collaborate dialog on
every device.
The repository's README covers configuration: retention, size limits (1 MB frames, 64 MB blobs), per-room storage quotas, rate limits, and optional access tokens. A self-hosted relay keeps media until you add an expiry rule to its R2 bucket; the README shows how. The relay has no accounts: holding a room ID is the credential, and a room ID is derived from a 256-bit key. If you self-host, put it behind Cloudflare Access or an IP allow-list, or turn on its access tokens, if you want a second factor. DeepState never sends licence information to a relay other than its own.
What the relay sees
| The relay knows | The relay does not know |
|---|---|
| A room ID (a hash) | Which board, license or person it belongs to |
| Ciphertext frames and their sizes and times | Any node content, titles, URLs or names |
| Encrypted blobs under hashed names | Original file names or contents |
| The IP addresses that connect | Device identities (device IDs are inside the ciphertext) |
DeepState's hosted relay only serves licensed installs: the app fetches a short-lived access
token from the licence server and sends it with every request to relay.getdeepstate.app. The
token identifies the licence to the relay only as an opaque hash, for rate limiting. It does not
grant access to any room: anyone who knows a room ID could still read that room's ciphertext,
and since the room ID is a hash of the key, the only way to know it is to hold the key, at which
point one could decrypt anyway. Rotating the key (stop sharing, create a new invite) moves the
board to a fresh room.
Troubleshooting
- Stuck on Connecting…. Check the URL (it must start with
https://), and that outbound WebSocket connections are allowed on your network. Corporate proxies that strip WebSockets will block it; the app falls back to reconnecting with backoff up to once a minute. - Connected, nothing arrives. The other device must be connected to the same relay URL with the same key. Ask them to click Push full history.
- "History no longer available". See Retention and re-seeding above.