Passwords, crypto keys, and documents you'd never share with anyone — except the right people, at the right time. Here's how we protect them.
Every secret is encrypted in your browser with AES-256-GCM — we store ciphertext only, so a full database breach exposes nothing usable. You pick a protection level per secret, all the way up to a zero-knowledge tier that even we can never read.
Every secret is encrypted client-side using AES-256-GCM with a random 96-bit IV. We store only ciphertext, so even if our database is breached, your data is unreadable.
Choose a level for each secret. Regular uses your vault key for instant access. Premium adds a master password run through 600,000 PBKDF2 iterations. Gold uses Argon2id (64 MB, memory-hard) — roughly 1,000× costlier to brute-force.
For your most sensitive secrets, the value is encrypted in your browser and wrapped only to your chosen trustees' keys — never to us and never back to you. It is write-only: only your trustees can ever decrypt it, and only after the trigger. A database breach reveals nothing.
Files are encrypted in your browser before upload. Each file gets a unique encryption key, which is itself wrapped with your vault key. The encrypted buffer is uploaded to Supabase Storage. Decryption happens entirely in your browser on download.
After the trigger, your trustees sign in from any device — years later — with just their own login. No hardware key, QR code, or browser file to lose. Access is gated by PostgreSQL row-level security, and protected-tier secrets carry a per-trustee wrapped key so only assigned trustees can open them.
Accounts can be protected with TOTP two-factor authentication from any authenticator app. When enabled, it is enforced at sign-in (AAL2) before the vault can be reached.
Uploaded death certificates are stored in a private Supabase Storage bucket with row-level security. Only admins can access them for review. Files are never publicly reachable.
Every database table has RLS enforced at the PostgreSQL level. Your rows are invisible to any other user — even with a valid session token.
All traffic is encrypted in transit with TLS 1.3. HTTPS is enforced with HSTS headers. No plain-HTTP fallback.
60 requests per minute per IP on all API routes. Auth endpoints have stricter limits to prevent brute-force attacks.
Admin operations use a service-role key held server-side only — never exposed to the browser. Admin reads never return encrypted payloads.
All admin actions (trigger vaults, approve certificates, change tiers) are logged with actor, timestamp, and target.
Account deletion triggers a hard purge of all secrets, files, and trustee data from the database and storage.
Read the source, or reach out directly.