Zero-Database Architecture: Why Not Storing Records is the Ultimate Security Model
A deep dive into stateless system design: how storing cryptographic parameters in cloud object headers eliminates database injection, leaks, and server-side tracking.
What You Don't Have Can't Be Leaked
The safest data is the data that was never collected. Every traditional web service maintains a relational database containing users, email addresses, passwords, IP logs, and upload histories. When hackers compromise the server, they obtain this master database.
Locky operates on an uncompromising zero-database model. There is no SQL database, NoSQL cluster, or cache table storing a directory of uploaded files.
Key Architectural Takeaways
- No central database exists to be breached, dumped, or subpoenaed.
- Security parameters travel exclusively in immutable cloud object headers.
- When an object is deleted, all associated metadata vanishes simultaneously.
How Object Headers Replace Database Records
In Locky, each file's metadata—including salted scrypt hash, salt, created-at timestamp, content-type, and size—is stored directly in the custom metadata headers of the encrypted cloud object (x-amz-meta-*).
There is no secondary index linking media IDs together. An attacker with access to server application code cannot list all vaults, query user activity, or reconstruct historical upload patterns.
Zero-Log Operational Philosophy
Server application logs strictly mask sensitive parameters. IP addresses are evaluated in memory for rate limiting and ban enforcement, but are never written to disk or persisted in database tables.
Try Zero-Knowledge Ephemeral Sharing
Need to share a photo or video privately without permanent digital footprint? Locky strips location metadata client-side in your browser, locks media behind a 4-digit numeric PIN, and guarantees automatic self-destruction in 24 hours.
Related Knowledge Base Guides
EXIF Metadata & Geotags: What Photos Reveal About Your Location
A deep dive into Exchangeable Image File Format (EXIF) data, GPS latitude and longitude tracking, and why client-side metadata sanitization is critical before sharing photos online.
Ephemeral StorageThe Dangers of Permanent Cloud Links: Why 24-Hour Self-Destruct Protects You
Why traditional cloud drives like Google Drive and Dropbox create persistent security vulnerabilities, and how automated ephemeral lifecycles eliminate link-rot and data leaks.