Megh — Zero-Knowledge Encrypted Cloud Storage

Megh (मेघ) means "cloud" in Sanskrit — a privacy-first, end-to-end encrypted cloud storage platform.

Megh is a zero-knowledge, client-side encrypted cloud storage platform. Your files are encrypted, split into chunks, and distributed across multiple storage providers before they ever leave your device. Not even Megh's servers can read your data.

Key Features

• 🔐 Zero-Knowledge Encryption — Files are encrypted client-side using XChaCha20-Poly1305. Encryption keys never leave your device.
• 📦 Content-Defined Chunking — Files are split into content-defined chunks using FastCDC, enabling efficient storage and deduplication.
• 🔑 Shamir's Secret Sharing — Optional 2FA recovery using cryptographic secret sharing (k=3, n=5).
• 🖥️ Provider-Agnostic — Supports multiple storage providers simultaneously (Google Drive, Dropbox, Backblaze B2, and more).
• 🔍 File Intelligence — AI-powered file analysis, tagging, and search (all processed client-side).
• 📱 Responsive Design — Full-featured web app with mobile support.
• 🛡️ Audit Logging — Comprehensive audit trail for all file operations.

Architecture

┌─────────────────────────────────────────────────┐
│                   Web Client                     │
│  ┌──────────┐  ┌──────────┐  ┌──────────────┐  │
│  │ Encryption│  │ Chunking │  │ File Analysis│  │
│  │ XChaCha20 │  │ FastCDC  │  │  (Client)    │  │
│  └────┬─────┘  └────┬─────┘  └──────────────┘  │
│       │             │                           │
│  ┌────▼─────────────▼──────────────────────┐    │
│  │         Cloudflare Workers API           │    │
│  │  (Authentication, Metadata, Routing)     │    │
│  └────┬─────────────┬────────────────┬─────┘    │
│       │             │                │           │
│  ┌────▼──┐    ┌─────▼───┐    ┌──────▼──────┐   │
│  │Supabase│   │   D1    │    │    Redis     │   │
│  │ (Auth) │   │(Metadata)│   │  (Rate Limit)│   │
│  └────────┘   └─────────┘    └─────────────┘   │
│                                                  │
│  ┌──────────┐  ┌──────────┐  ┌──────────────┐  │
│  │Backblaze │  │  Google  │  │   Dropbox    │  │
│  │   B2     │  │  Drive   │  │              │  │
│  └──────────┘  └──────────┘  └──────────────┘  │
└─────────────────────────────────────────────────┘

Tech Stack

Layer	Technology
Frontend	Next.js 16, React 19, TypeScript, Tailwind CSS, Framer Motion
Backend	Cloudflare Workers (Hono), D1 Database, R2 Storage
Auth	Supabase Auth
Crypto	XChaCha20-Poly1305, Argon2id, HKDF-SHA512, BLAKE3, Shamir's Secret Sharing
Cache	Upstash Redis
Monorepo	Turborepo, pnpm
Storage	Backblaze B2, Google Drive, Dropbox (pluggable)

Getting Started

Prerequisites

• Node.js >= 20.9.0
• pnpm 9.x
• A Supabase project
• A Cloudflare account (for Workers, D1, R2)

Installation

# Clone the repository
git clone https://github.com/ravenwit/Megh.git
cd Megh

# Install dependencies
pnpm install

# Set up environment variables
cp apps/workers/.dev.vars.example apps/workers/.dev.vars
# Edit .dev.vars with your credentials

# Start development servers
pnpm dev

Configuration

1. Supabase: Create a project and run the migrations in supabase/migrations/
2. Cloudflare: Configure your Workers, D1 database, and R2 bucket
3. Storage Providers: Set up OAuth credentials for your desired storage backends
4. Environment: Fill in apps/workers/.dev.vars with your API keys

Project Structure

megh/
├── apps/
│   ├── web/                    # Next.js frontend
│   │   ├── app/                # App router pages
│   │   ├── components/         # React components
│   │   ├── hooks/              # Custom React hooks
│   │   ├── lib/                # Utility functions
│   │   └── workers/            # Web Workers (encryption)
│   └── workers/                # Cloudflare Workers API
│       ├── src/
│       │   ├── providers/      # Storage provider integrations
│       │   ├── routes/         # API route handlers
│       │   └── middleware/     # Auth & validation middleware
│       └── migrations/         # D1 database migrations
├── packages/
│   ├── crypto/                 # Shared crypto utilities
│   └── types/                  # Shared TypeScript types
├── supabase/
│   └── migrations/             # Supabase database migrations
└── resources/                  # Design docs & planning

License

Business Source License 1.1 (BSL-1.1)

This project is source-available under the BSL 1.1:

• View and audit the full source code — transparency is our foundation
• Non-commercial use (personal, research, evaluation) is free
• Commercial use requires a commercial license

The code will automatically convert to Apache License 2.0 on 2029-07-31.

Commercial Use

If you're a commercial entity looking to use Megh in production, you need a commercial license. This supports the project's ongoing development and ensures the licenses can fund continued innovation.

Security

• All encryption happens client-side in Web Workers
• Files are chunked and encrypted before transmission
• Encryption keys are never sent to the server
• Zero-knowledge architecture: the server stores only encrypted blobs and metadata
• Full source code transparency — anyone can audit the crypto

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines. All contributors must sign a Contributor License Agreement (CLA).

Contact

• GitHub Issues: https://github.com/ravenwit/Megh/issues
• Commercial Inquiries: See COMMERCIAL_LICENSE.md

---

Built with ❤️ for privacy.