Security

How OutVault keeps your files private.

Every file is sealed on your device before it goes anywhere, and only your devices can open it — everything on this page follows from that.

The model

What happens to a file you add

Three steps, in an order that matters: the lock comes first, on hardware you own.

Step 1
Sealed on your device
The moment a file enters the vault it is encrypted on your phone or computer. From then on it is unreadable without your keys — and your keys never leave you.
Step 2
Synced as unreadable data
What travels to our servers, and what rests on them, is sealed data. We store it and move it between your devices; opening it is not something our systems can do.
Step 3
Opened only on your devices
Your vault unlocks where your keys are — on your devices. There is no server-side door, because there is no server-side key.

What that means in practice

None of these are policies we ask you to trust. They are consequences of where the keys live.

A breach here exposes sealed data

If OutVault's servers were ever broken into, what the intruder carried away would be encrypted files without the keys to open them — unreadable to us, unreadable to them.

Nobody at OutVault can open your files

There is no admin view of a vault. No employee, no support tool, no server ever holds your keys, so no one here can read what you keep.

We can't hand over what we can't read

A request for your files — from anyone — can only be answered with sealed data, because sealed data is all that exists on our side.

The limits

What encryption cannot do

End-to-end encryption locks one door — the one between your files and everyone who isn't you. Three things live outside that door, and you should hear them from us.

A stolen device that's unlocked

Someone holding your phone with the vault open sees what you see — no encryption changes that. Keep your device's own screen lock on, set to lock quickly.

A passphrase that's easy to guess

Your passphrase is the key, and the lock is only as strong as the key is hard to guess. Make it long rather than clever — a few unrelated words you can remember.

A person you trust, passing it on

Once someone has what you sent them, encryption can't control what they do next. Share with people you trust.

A full technical write-up of the encryption design ships as the app reaches public release.