1. Zero-knowledge architecture
Your vault is encrypted and decrypted exclusively on your device. The server only stores encrypted data and never receives your master key. That is why not even we can read your content.
2. End-to-end encryption
We encrypt content with AES-256-GCM, an authenticated cipher that protects both confidentiality and integrity.
To share keys between devices we use X25519 (ECIES). These are widely audited standards used by banks and governments.
3. Key derivation
Your master key never travels. On your device, cryptographic material is derived with PBKDF2-HMAC-SHA256 (with a high iteration count) and HKDF.
Only an authentication hash reaches the server, not your key. A wrong master key fails at authentication and, as an added defense, at decryption (GCM authentication).
4. On-device protection
Biometric unlock (Face ID / fingerprint), auto-lock on inactivity, secure clipboard wiping, and screen-capture protection help keep your secrets safe even when the device is in someone else’s hands.
5. Account protection
Progressive lockout after several failed unlock attempts, two-factor authentication (TOTP 2FA), and per-device trust so only your approved devices can access the account.
6. Infrastructure
All traffic travels encrypted with TLS. In the database, row-level security (RLS) policies ensure each user can only access their own records, which are themselves end-to-end encrypted.
7. Recovery and Emergency Kit
Since no one but you can decrypt your vault, there is no "forgot my password" we can resolve for you. When you start, we give you an Emergency Kit: keep it offline and safe to regain access if you forget your master key.
8. Responsible disclosure
If you believe you have found a vulnerability, we appreciate a responsible report to emeldoquiroz01@gmail.com. We will investigate and respond as promptly as possible.