Last updated 2026-07-01
Encryption
All connections use TLS 1.2 or higher with modern cipher suites and HSTS. Data at rest in our database and object storage is encrypted with AES-256. Vault content is additionally encrypted on your device with a key derived from your master password, so we store only ciphertext.
Access control
Row-level security policies scope every database read and write to the authenticated user. Administrative access requires two-factor authentication, is granted on a least-privilege basis, and is logged to an append-only audit table.
Application security
Inputs are validated against schemas on the server, output is escaped by default, a strict Content Security Policy is applied, and state-changing requests require a CSRF token. Endpoints are rate limited. Dependencies are monitored for known vulnerabilities.
Resilience
Databases are backed up daily with point-in-time recovery, and restores are tested periodically. Errors and performance are monitored continuously with alerting.
Honest limits
No product makes an account unbreakable, and we do not claim otherwise. These controls reduce risk; they do not eliminate it, and they cannot protect data on a device that is already compromised.