The three pieces
Three pieces, with a deliberate split of knowledge between them. Each one holds what it needs and nothing more.
LockFlare Cipher — the desktop app
A native application for macOS and Windows. It is where you import projects, manage environments and servers, push builds, watch fleet health and administer your team. It is also the only place your source is ever read in plaintext by LockFlare software.
Cipher runs on your machine, next to your code. It packs and encrypts locally, then talks to the control plane over an authenticated channel. It never uploads anything readable.
The control plane
The coordination layer. It holds accounts, permissions, environments, server registrations, licences, deployment manifests and the activity log — and it holds your builds as ciphertext.
What it does not hold is a way to read them. Build artifacts arrive encrypted and are stored exactly as received. The control plane orchestrates which version belongs on which server; it is not a party to the contents.
LockFlare Engine — the runtime
A single binary installed as a system service on each of your servers. It registers with its licence, fetches the builds assigned to it, decrypts them into memory and serves traffic.
It is deliberately the only thing on the machine. A LockFlare server is an appliance, not a general-purpose host — no database alongside it, no second application, no files that matter. That constraint is what makes it disposable: if the box is lost, corrupted or sealed shut, you install the Engine on a fresh one and push every project back. Minutes, not a recovery project.
Node runtime
Hosts JavaScript projects. Per-domain isolation through Node’s native vm
module, so one tenant’s code cannot reach another’s. Requires Node.js 24.
.NET runtime
Hosts ASP.NET Core projects. Roslyn compiles in memory into a collectible
AssemblyLoadContext, so a reload frees the old assembly cleanly. Requires .NET 10.
How they fit together
| Cipher | Control plane | Engine | |
|---|---|---|---|
| Runs on | Your laptop | LockFlare | Your servers |
| Sees plaintext source | Yes — it is your machine | Never | In RAM only |
| Holds encryption keys | Yes | Yes, per account | For its own builds |
| Knows your topology | Yes | Yes | Only itself |
| Writes plaintext to disk | No | No | No |
One more consequence worth naming: because the Engine only knows about itself, compromising one server tells an attacker nothing about the rest of your fleet. There is no shared secret sitting on every box.