Protection you can read about in plain words.

Your master password and Secret Key never leave your device. The unlock key is derived with PBKDF2-SHA256 (650,000 iterations) over a salt bound to your Secret Key.

Every vault item has its own AES-256-GCM key, wrapped under the vault key; vault keys are wrapped per member with RSA-OAEP-2048. The server stores ciphertext and wrapped keys only.

Attachments are encrypted under the item key before upload. Share links carry their key in the URL fragment, which never reaches our servers, or wrap it under a passphrase.

If you lose both your master password and your Secret Key, we cannot recover your personal vault. That is the point. Download and keep the Emergency Kit.

Passkeys (WebAuthn) and TOTP second factor on your account, with new-device alerts.

Rate limiting on sign-in and one-time codes; passwords are checked against known breaches using k-anonymity, so the password itself is never sent.

Sessions can be ended from any device.

Each completed document is sealed with a SHA-256 fingerprint and a completion certificate listing every signer, the time, the IP address and the authentication method used.

Anyone can check a document on the public verify page: it compares the file against the recorded fingerprint and shows the certificate.

These are electronic signatures with an audit trail. Their legal effect depends on the use case and jurisdiction; they are not qualified electronic signatures.

TLS on every connection, HSTS, encryption at rest for databases, files and backups.

Strict tenant isolation: every request is scoped to the authorised account or team at the data layer.

Staff cannot read vault contents. Support access to account metadata is logged.

Backups are encrypted and restores are tested. An independent penetration test is scheduled before public launch.

No "bank-grade" or "military-grade" language. No government approval. No ISO 27001 or SOC 2 claims until we hold the certificates and can show them.

No data-residency promise until production actually runs in that region.