# Recovery

Witbitz deliberately has no operator recovery key. If the platform could recover a Space, the platform could read a
Space. Recovery must therefore belong to the user or organization, not to Witbitz as operator.

This page explains the current tradeoff and the roadmap. The full lifecycle discussion is in
[The Verified Room](./room-link-auth.md).

---

## Current rule

If every copy of the room key is lost, the Space is lost.

That is not a product flourish; it is the cost of the privacy claim. The production envelope is sealed to the room key,
not to an operator, support, escrow, or beta recipient. There is no backdoor recipient to call later.

You can verify that with the sealed-store check:

```bash
curl -sX POST "$SPACE" \
  -H 'content-type: application/json' \
  -d '{"op":"sealed","room":"<ROOM>"}'
```

The recipients list should name the room, not the operator.

Read: [Verify it yourself](./verify.md)

## What recovery should be

Recovery can exist, but it must be user-held:

| Mechanism | Owner |
|---|---|
| Recovery code | The user stores it. |
| k-of-n social recovery | Several trusted parties hold shares. |
| Device keystore/passkey | The user's platform syncs or protects the key. |
| Organization key policy | The customer controls it in its own boundary. |

None of these require Witbitz to hold a readable recovery recipient.

## What the Companion would add

The optional Companion was originally imagined as a native runtime for notifications, durable keys, and local decrypt.
Much of that is now possible with the installed web app and passkeys, so the Companion is no longer a platform pillar.

It may still improve recovery ergonomics:

- keep room keys in a device keystore
- make rotation less dependent on pasted links
- deliver new epoch keys to devices instead of URLs
- provide more reliable background notifications

Read: [The Companion](./the-companion.md)

## Enterprise/on-prem recovery

In an on-prem deployment, the organization controls the runtime boundary. That can include its own backup policy,
identity provider, secret storage, and recovery procedure. The privacy story changes from "trust Witbitz not to read"
to "verify the image you run and control the boundary yourself."

Read: [Enterprise and on-prem](./on-prem.md)

## What not to promise

Do not promise that Witbitz can recover a lost Space on hosted production. It cannot, by design.

Do not hide the user burden. User-held recovery is safer than operator-held recovery, but it still requires a recovery
artifact, another device, a passkey sync provider, a social recovery set, or an organizational process.