What happens if Canna GLAP gets hacked?

A thief would get your grow only as scrambled data they cannot open, because the key stays with you. They could see a short list of account details, and that list is below.

Have you ever read one of those "we were breached" emails and wondered what they really took? No company can promise it will never be broken into. So we asked a different question: what if it happens anyway? Canna GLAP is built so the answer is boring.

Think of a bank's safe deposit boxes. We keep the boxes. Only you have the key. Someone who breaks into the vault can carry boxes away, but they cannot open yours, and neither can we.

What would a thief find?

Your plants, strains, feed logs, harvests, stock, photos, Cannie conversations and room sensor readings are locked on your phone before they are ever sent to us. End-to-end encrypted means only the person holding the key can read the data. A thief who copies our whole database gets that locked data and nothing that opens it.

The key is made on your phone and never leaves it in a form anyone can use. We keep only locked copies of it, sealed with your passphrase or your recovery phrase, which we cannot open; that is how a new phone of yours gets back in. Your grow is locked with AES-256, the same strength of encryption banks use, and your passphrase is protected with Argon2id, which makes guessing it slow and costly.

What could a thief see?

We would rather tell you now than have you find out later. To run the app, bill you and keep accounts safe, some things are not locked:

Your account details: email, name, date of birth, and the country, state and city you gave when you signed up.
Your subscription: whether it is active, and when it renews or ends.
Your farm's name and town, which we use for weather.
Who is on your team, and their role.
Your sensors' names and when they report, but not their readings.
Security records, such as when you signed in and from what internet address.

Your password is not on that list. It is stored scrambled by our sign-in provider, so nobody, us included, can read it. The privacy policy lists every item we hold.

What could a thief not do?

Read your grow records or see your photos.
Make a key that opens your grow.
Open your grow by changing the locked data. Changed data simply will not open.
Open your grow by signing in to your account on a new phone. A new phone still needs your passphrase or recovery phrase.

Is there anything a lock cannot protect?

Yes, and you should know it. Your grow can be opened by:

someone holding your phone who can unlock it and sign in to your account on it (a phone where you have opened your grow remembers the key, so you do not retype your passphrase every time);
someone who has your account sign-in and your passphrase;
someone who has your 24 word recovery phrase.

Room sensor readings are shared, by design, with the people on your farm team: their phones hold the farm's sensor key. Nothing else from your grow is shared with them.

And when you ask Cannie a question, your question, any photo with it, your recent chat with her and a short summary of your plant and room are sent readable to our AI provider to get the answer. Nothing else from your grow leaves your phone readable.

The other side of a lock only you can open: if you lose both your passphrase and your recovery phrase, nobody can open your grow again, including us.

How do I keep my key safe?

Use a passphrase you use nowhere else.
Write your 24 word recovery phrase on paper and keep it somewhere safe, not in a photo or a notes app.
Turn on two-step sign-in in the app's Security settings.
Lock your phone with a passcode, Face ID or fingerprint.
Never give your passphrase or recovery phrase to anyone, even someone who says they are from Canna GLAP.

What would Canna GLAP do if it happened?

We would tell the people affected, and the authorities, as the law requires, and tell you what to do. Because your grow was locked before it reached us, what we would have to tell you about is the short list above, not your grow.

Questions people ask

What happens to my grow if Canna GLAP is hacked?

A thief who copies our database gets your grow only as scrambled data, with nothing that opens it. The key that opens your grow stays with you; we keep only locked copies of it that we cannot open.

What could a hacker see?

Account details (email, name, date of birth and the location you gave at sign-up), your subscription status, your farm name and town, your team, your sensors' names and when they report, and security records such as sign-in times and internet addresses. Not your grow.

Can a hacker see my password?

No. Your password is stored scrambled by our sign-in provider, so nobody, us included, can read it.

Can someone who signs in to my account read my grow?

Not on a new phone. A new phone needs your passphrase or your 24 word recovery phrase before it can open anything.

Would you tell me if it happened?

Yes. We would tell the people affected, and the authorities, as the law requires, and tell you what to do.