Security architecture
Where something is a limitation, it is labelled as one. A security page that only lists strengths is marketing, not documentation.
No custom cryptographic primitives. Every algorithm is standard and every implementation comes from an audited library or the platform.
Master-password key derivation
64 MiB of memory, 3 passes, 4 lanes. Memory hardness is what makes custom guessing hardware expensive rather than merely slow. Parameters are stored per account and can be raised later without re-encrypting anything.
Authenticated encryption
A 192-bit nonce means uniformly random nonces are safe without counter state, removing the single most catastrophic failure mode in a system where many devices encrypt independently and offline.
Sharing
Vault keys are sealed to a member’s public key, so sharing never re-encrypts content and adding a member is one small operation rather than a re-upload.
Login challenges
Your device signs a challenge. No password and no password hash is transmitted or stored — a database breach yields no credential that can be replayed.
Integrity
Per-chunk and whole-file hashes, plus the chained hashes that make the audit log tamper-evident.
The one composite construction — chunked file encryption — is the published STREAM design, the same approach used by age and libsodium's secretstream. We compose standard parts; we do not invent them.
This separation is the reason a working sign-in does not imply a readable vault.
Your master password is derived once, then split into two independent keys: one unlocks your vault, one signs login challenges. The server only ever holds the public half of the signing key.
There is no password hash column, because there is no password to hash. Someone reading our database finds public key material, which authorises nothing on its own.
A stolen token reaches the API as you and receives ciphertext. Tokens are short-lived, rotate on every refresh, and reusing a consumed one revokes the entire session family.
Every encrypted value carries an authenticated header recording the algorithm, the key generation, the level of the key hierarchy, and which object it belongs to.
Altering any of it breaks authentication — so a ciphertext cannot be moved from one field, item or file into another, and there is no older version to downgrade to.
Files are encrypted in chunks, each independently authenticated and bound to its position and its file. Truncating, reordering, duplicating or splicing chunks all fail.
A whole-file hash is checked before anything reaches your disk, so a partially verified file is never handed to you. Key material is never previewed automatically and needs a download permission separate from viewing.
Stated precisely, with no marketing adjectives.
We do not claim to be unhackable. We cannot protect you from malware on your own device, and we do not scan encrypted files for malware, because we cannot read them. The full list is here, and it is deliberately not buried.
Every claim on this page is testable, and the tests ship with the source.
Create a vault