Security Disclosure

How VAUULT protects your vault

AES-256-GCM encryption

VAUULT uses AES-256 in GCM mode for authenticated encryption of local records. GCM provides confidentiality and tamper detection, so unauthorized modifications can be detected during decryption checks.

Device-Bound Keys promise

Encryption keys are derived and retained on-device. VAUULT does not upload raw decryption keys to external services. This device-bound model reduces key exposure risk and aligns with our zero-knowledge architecture.

Offline-first security posture

Core vault operations are designed to function offline. By minimizing network dependency for read/write access to sensitive records, VAUULT reduces attack surface introduced by remote synchronization paths.