Trust Center · Changelog
Security changelog
A high-level summary of security-relevant improvements, newest first. It contains no exploit details; findings appear here only after they are fixed.
Organization security policies
Organization owners and admins can require two-step sign-in for members (enforced by the server), turn off moving shared items into personal vaults (enforced by the server) and set a maximum auto-lock time (enforced in the app). Changes need the master password and a second factor, and are written to the audit log.
Security report, breach check and sign-in alerts
Launched the vault security report, an opt-in k-anonymous breach check, and email alerts for new devices and repeated failed sign-ins.
Trust Center published
Security whitepaper, vulnerability disclosure policy, incident response, infrastructure and this changelog. security.txt now points to the disclosure policy.
Internal security review #5
The lookalike (homograph) domain check was extended to catch non-letter symbols and Latin lookalike letters. Regression tests were added for the sharing and re-sharing paths.
Second factor for ownership transfer and organization deletion
These actions now require the master password and, if enabled, a current second factor; ownership cannot be transferred to a disabled account.
Homograph warnings
Unicode domain names are shown in readable form; suspicious ones are flagged with a warning and the real (punycode) address.
Internal security review #4
Findings were fixed, including shared keys signed by a manager who deleted their account becoming unreadable, subscription ownership, and file permissions in deployment scripts.
Encrypted offsite backups and monitoring
An offsite copy of the encrypted backup with a separate provider (transferred over encrypted connections only); monitoring and email alerts for service health, certificate, disk and backup freshness.
Self-service account deletion
You can permanently delete your account in Settings with your master password and second factor (KVKK Articles 7 and 11).
Operator panel and internal security review #3
Changes in the operator panel require re-authentication and are written to a separate audit log. Billing and invitation findings from review #3 were fixed.
Internal security review #2: silent TOFU removed
Shared keys are only accepted from signers the user pinned through visible steps. Adding two-step login requires the master password, and changes to two-step login trigger a security email.
Row-level security
PostgreSQL row-level security and an unprivileged application role were added as a second line of defense behind application checks; critical columns are protected by triggers.
Signed sharing with key epochs
Wraps of shared vault keys are signed with Ed25519 and bound to an epoch; clients refuse to write with an older epoch.
Passkeys, TOTP and the Emergency Kit
A second step at sign-in (passkeys and authenticator apps) and account recovery with a recovery code.
Internal security review #1
Sign-up takeover and account enumeration through sign-up were closed. Session revocation races were fixed; sessions got a 90-day absolute lifetime and key derivation parameters got downgrade protection.
Nonce-based CSP and security headers
A Content Security Policy with a fresh nonce on every request, HSTS and other security headers.
Encrypted backups
Daily database backups are encrypted to a public key with age; a restore test was added.
Crypto core and test vectors
Format version 1 built on Argon2id, XChaCha20-Poly1305, X25519 and BLAKE2b; standard test vectors and frozen format vectors.
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.