Private by design. Encrypted by default.
Haven is the browser-side surface of MindooDB's trust model. Data is encrypted on the client before it ever reaches a server, apps run in sandboxes with granular permissions, and you choose where the data actually lives.
Keys stay on the client
Haven builds on MindooDB's end-to-end encryption. Documents, attachments, and history are encrypted on your device before they leave it. Servers - including the Mindoo demo server and any server you run yourself - only store ciphertext.
- Client-side keys under user control, never uploaded as plaintext.
- No plaintext passes through Haven, the sync server, or the hosting infrastructure.
- Signed, append-only history inherited from MindooDB core.
- Content-addressed sync exchanges only the encrypted entries a device is missing.
See the MindooDB Security Model and Architecture for the full cryptographic design that Haven consumes.
Start local, publish when you are ready
Haven does not force you onto a server on day one. You can create the full MindooDB world locally and bring people in later, under your terms.
Generate users, admins, tenants, and databases entirely in the browser - even offline. No desktop install, no account required.
Keep editing while the network is gone. Haven resumes sync automatically when connectivity returns.
When a tenant is ready for collaboration, push it to a MindooDB server and invite members through a guided onboarding flow.
Tenant access and required encryption keys are shared through the onboarding flow, not copy-pasted out of band.
Push-only, pull-only, or bidirectional
Each Haven-to-server connection can be configured independently. Pick the mode that matches your workflow:
- Push-only - publish changes upstream, for example from a field device to a central archive.
- Pull-only - read from a server without contributing local changes, for reporting or read-only clients.
- Bidirectional - full two-way collaboration for everyday teamwork.
Because MindooDB's wire format is content-addressed, sync always transfers only the encrypted entries a peer is missing - no matter which mode you pick.
Built-in backup for in-browser data
Haven ships with a backup function for the data stored locally in the browser. Use it to keep offline tenants safe, snapshot a state before risky operations, or migrate between devices.
- One-click backup of the current Haven instance's data.
- Works locally even without a server connection.
- Complements server sync when you run a MindooDB server yourself.
- Automatic backup is planned for Haven Enterprise.
Apps only see what you grant them
Apps in Haven are strictly isolated. They cannot reach Haven's storage, your other apps, or data you have not explicitly shared.
- Sandboxed iframes on separate origins for every app.
- Opaque-origin sandbox for Haven-hosted app bundles served by the service worker.
- No shared storage - all data flows through the Haven bridge under explicit consent.
- Capability-based permissions covering read, create, update, delete, history, attachments, and view creation.
- Per-app scoping - apps only see the databases and views you grant them.
Explain collaboration, do not hide it
Navigate a document's full change history as a graph. See who changed which fields, when, and how Automerge's merge logic combined concurrent edits. Great for debugging and provenance.
- Authorship and field-level attribution across merges.
- Helps explain CRDT behavior to users without hand-waving.
- Useful for audits and compliance narratives.
A secure analytical layer on top of encrypted data. Filter, categorize, sort, and aggregate documents across a database, multiple databases, or multiple tenants - all evaluated under the same permission model.
- Operational dashboards, rollups, and worklists without exposing raw data.
- Haven and apps can share views or define their own.
- Column formulas, filters, and derived structure through a typed builder.
Three topologies, one client
Haven Community supports every mode out of the box. You can move between them without changing clients - only the connection target changes.
Tenants stay on the device. No server, no sync, no account. Perfect for personal notes, drafts, or offline demos.
- Zero infrastructure.
- Ideal for evaluation and single-user use.
- Pair with Haven's built-in backup for safety.
Push a local tenant to the hosted Mindoo demo server and invite real collaborators over real sync.
- Fastest way to experience multi-user Haven.
- Data on the demo server is wiped periodically.
- Use it for evaluation, not for production data.
Run your own MindooDB server and point Haven at it. You keep ciphertext; Haven stays the same client.
- Follow README-server.md for setup.
- Commonly combined with Haven Enterprise and professional support.
- Plays well with push-only, pull-only, and bidirectional sync modes per connection.