Skip to content

Holochain Architecture

How Flowsta uses Holochain for decentralized, zero-knowledge identity storage.

Two-DNA Architecture

Flowsta uses two separate Holochain DNAs to separate public and private data:

Identity DNA (Public)

FieldDescription
Display nameUser's chosen display name
Profile pictureURL or hash of profile picture
Agent public keyEd25519 public key
Agent linksIsSamePersonEntry attestations from agent linking

The Identity DNA is publicly readable. Any participant in the DHT can query another user's public profile.

Private DNA (Encrypted)

FieldDescription
EmailEncrypted with user-derived key
Recovery phraseEncrypted backup of BIP39 mnemonic
SessionsEncrypted session data
OAuth logsActivity audit trail
2FA configTOTP configuration (encrypted)

All Private DNA data is encrypted client-side before storage. Even Holochain validators cannot read the plaintext.

Infrastructure

Holochain infrastructure diagram showing global DHT nodes across Americas, Europe, and Asia-Pacific regions, user devices running Flowsta Vault with a local conductor, and future community nodes, all connected to the distributed hash table

Global DHT Nodes

Flowsta operates DHT nodes across multiple regions to ensure availability and low-latency access worldwide. As the network grows, the goal is to transition toward community-operated nodes — reducing reliance on Flowsta-managed infrastructure and strengthening the network's decentralization.

Flowsta Vault (Local)

When users install Flowsta Vault, it runs a local Holochain conductor that joins the same DHT network. This means:

  • User data is replicated locally
  • Agent linking attestations gossip across the network
  • The network becomes more resilient with each Vault install

Key Derivation

Key derivation from BIP39 recovery phrase through HMAC-SHA256 to Ed25519 keypair producing agent public key, DID, and signing key

Every user's keypair is deterministically derived from their recovery phrase. This means:

  • Same phrase always produces the same identity
  • Users can restore their identity on any device
  • No key escrow or central key server needed

Holochain Version

Flowsta runs on Holochain 0.6.0 with the kitsune2 networking layer.

Next Steps

Documentation licensed under CC BY-SA 4.0.