FLASH DB

Built for intelligence that never leaks

Scroll — every layer is encryption-first, not a plugin bolted on later.

🔐

Fail-Closed by Default (since 1.2.0)

Daemons require authKey. The console requires a token. Weak secrets and accidental plaintext fields are rejected. Public bind is opt-in.

🧱

Universal Foundations

Cross-domain primitives — eventLog, counter, queue, lifecycle, pagination, health, snapshot — one API for apps, chat, games, AI, and jobs.

🧠

AI-Native Intelligence Layer

HNSW vector search, semantic cache, RAG context optimizer, NL query compiler, and LLM tool-calling — storage and AI in one engine.

🛡️

Server-Blind Architecture

Encryption is the foundation — not a feature flag. The engine stores ciphertext, trapdoors, and ORE tokens. Limits and leakage are documented in the trust model.

🔍

Searchable Blind Indexing

Exact matching ($eq, $in), partial text ($regex), and bucketed range queries ($gt, $lt) with honey padding — SSE still leaks patterns; design accordingly.

🔗

AAD Field Binding (Anti-Swap)

Each ciphertext is cryptographically bound to its record ID and field name, preventing ciphertext swapping attacks between documents.

🧮

Homomorphic Arithmetic

Compute sums and aggregations ($sum, $inc) directly over encrypted numerical fields without server-side decryption.

💾

Balanced Durability Engine

Configurable strict / balanced / throughput modes. Default balanced batches fsync (64 ops / 25 ms) with full sync on close. Atomic SSTable writes.

📊

Structured Logging

JSON structured logger with level filtering, sensitive key redaction, and integration with ELK, Datadog, Grafana Loki, and CloudWatch.

🌲

Tamper-Evident Merkle Roots

Cryptographic verification proofs to detect unauthorized modifications or disk injections within the Merkle threat model.

🏗️

Modern LSM-Tree Engine

Lock-Free SkipList MemTable + Append-Only WAL + Bloom Filtered Compressed SSTable segments with atomic writes.

🔒

Private RAG & Agent Memory

Encrypted ingest, semantic ask, agent episodic memory, LangChain adapter — intelligence without server plaintext.

📦

Portable & Federated

flashpack bundles, cloud sync, federated multi-peer queries, and encrypted CRDT for sovereign data mobility.

⚖️

Trust & Compliance Tools

Integrity proofs, GDPR export/erase helpers, prompt firewall, key ceremony — tools, not a compliance certificate. Audit roadmap published.

FLASH Intelligence Console — sealed vaults, private RAG, server-blind by design

Tests passing

0-bit

AES-GCM

Server plaintext

0M+

Ops/sec binary path*

*Binary path throughput depends on workload and engineOptions — see benchmarks.

Server-blind

Designed so the engine holds ciphertext

AES-256-GCM envelopes, blind trapdoors, and ORE tokens stay sealed. FlashZKKernel rejects unsealed records on the wire. Limits are public.

Trust model

AI-native

Private RAG & agent memory

Ingest, embed, ask, and recall without shipping secrets to a remote model host. Intelligence lives next to your key.

Private RAG

Fail-closed 1.3.0

Trust by default

authKey, console tokens, and strong secrets are mandatory since 1.2.0. Key wrap (FLASHTAKE1) in 1.3.0 — security still on you. No external audit yet.

What's new

Ship private intelligence

Start sealed in five minutes

One client. One key. Private RAG, agent memory, and a sealed vault — without giving the engine your plaintext. Read the trust model before regulated production.

Get Started What's New in 1.3.0

Mission

FLASH is the first line of privacy protection while AI is being built — RAG, agent memory, sealed documents — anywhere. By default flash-zk is strong. The developer can weaken it. Strength holds when the developer keeps the key and leaves protection on.

1.3.1 documents this. There is no extra code — same engine as 1.3.0. What's new

Read your responsibility: Mission · This week: Do this first · What we will tighten: Security ahead

Quick Example

Run once in your project: flashsh wrap-key (see flashsh CLI).

javascript

import { FlashClient } from "flash-zk";

const client = new FlashClient({
  storagePath: "./data",
});

const users = client.collection("users", {
  schema: {
    name: { type: "string", required: true, trim: true },
    email: { type: "string", required: true, unique: true },
    balance: { type: "number", default: 0 },
  },
});

const { insertedId } = await users.insertOne({
  name: "Ada Lovelace",
  email: "ada@computing-pioneer.org",
  role: "Mathematician",
  balance: 45000,
  status: "active",
});

const results = await users
  .find({ email: "ada@computing-pioneer.org" })
  .sort({ balance: -1 })
  .limit(10);

console.log(results[0].name); // 'Ada Lovelace'

FLASH DBPrivacy first, while AI is created