Content Security Policy tightened
Removed the last inline script exception on public pages by moving theme initialisation to a nonce-bound loader.
Trust Center
What we do, what we don't, and what we can prove
We publish our posture including the gaps. If a certification isn't held, this page says so rather than implying otherwise.
Architecture
Five layers, from your device outward
Vault content is encrypted before it leaves your device, so the server holds ciphertext it cannot read.
1
Your device
Vault items, notes, and files are encrypted here with AES-256-GCM. The key is derived from your master password using PBKDF2 with a high iteration count and a per-account salt. The master password and the derived key never leave the device.
2
Transport
All traffic uses TLS 1.2 or higher with modern cipher suites, HSTS with preload, and certificate transparency monitoring. Only ciphertext and operational metadata cross this boundary.
3
Application
Server functions validate every input against a schema, enforce authentication, and apply rate limits. A strict Content Security Policy and CSRF tokens protect state-changing requests.
4
Data
Row-level security policies scope every query to the authenticated user at the database level, so an application-layer mistake cannot expose another account's rows. Storage is encrypted at rest with AES-256.
5
Operations
Administrative access requires two-factor authentication and is least-privilege. Every administrative action is written to an append-only audit log. Backups run daily with point-in-time recovery and tested restores.
Encryption
What is encrypted, and how
| Data | Method | Held by |
|---|---|---|
| Vault items, notes, files | AES-256-GCM, key derived client-side | Your device |
| Database at rest | AES-256 | Managed cloud platform |
| Object storage at rest | AES-256 | Managed cloud platform |
| Data in transit | TLS 1.2+ with HSTS | Edge network |
| Password storage | Argon2id hashing, never reversible | Authentication service |
| Backups | Encrypted, 35-day rolling retention | Managed cloud platform |
Compliance
Frameworks and our honest status
Status labels are literal. 'Not yet started' means exactly that.
GDPR
Implemented
Lawful basis documented per processing activity, self-service export and deletion, DPA available for business customers, and Standard Contractual Clauses for transfers out of the EEA.
CCPA / CPRA
Implemented
Access and deletion requests supported through the same self-service flows. We do not sell or share personal information as those terms are defined, so no opt-out mechanism is required — but the preference is available anyway.
SOC 2 Type II
Not yet started
We have not begun a SOC 2 audit and do not hold a report. We will publish the timeline here when we start, and we will not imply readiness before then.
ISO/IEC 27001
Not yet started
No certification held. Our internal controls are modelled on the standard's guidance, which is not the same as being certified against it.
PCI DSS
Out of scope
We never receive or store full card numbers. Payment data is handled entirely by Stripe and Razorpay, who maintain their own PCI DSS compliance.
Testing
Penetration testing
An external penetration test has not yet been commissioned. We are scheduling the first engagement to follow the release of the vault and billing modules, so that the assessment covers the code paths that matter most.
- Scope: web application, authentication flows, vault encryption implementation, and public API.
- Method: authenticated and unauthenticated grey-box testing by an independent firm.
- Publication: a sanitised summary with severity counts and remediation status will be published on this page.
- Cadence: annually thereafter, plus a targeted review after any significant architectural change.
Incidents
Security incident history
No security incidents affecting customer data have occurred to date. If one does, it will be published here with impact and resolution, alongside direct notification to affected accounts.
Updates
Recent security work
Dependency review completed
Full audit of production dependencies with three transitive packages upgraded. No exploitable issues were identified in our usage.
HSTS preload submitted
The production domain was submitted to the HSTS preload list after a 90-day observation period.