Secure end-to-end
The idea was always that end-users would communicate with the Tap backend exclusively using encrypted data. Anything they send would be encrypted using a private key stored on their device (Android / iOS), and anything they receive would only be decryptable by them.
However, the companies would interact with a web app, rather than a mobile app, so there's no secure store for a private key, and given they're an organization rather than an individual, there'd probably have multiple users too.
The initial design concept was based around Tap hosting the keys for the company, and acting as a trusted source in the system. However, as I looked into the options available it became clear that libsodium was totally workable on the frontend, in the browser, so the problem was limited to securely serving them the private key.
The design we went for in the end was to use AES to encrypt the Sodium private key client-side via a passphrase that never leaves the browser, this allowed Tap to store the encrypted private key and serve it up to any team member of the organization, without being able to decrypt the data themselves, all they needed to do is enter the passphrase after they sign in.
