Security
The specifics, stated plainly.
Software that handles your professional work should be entirely transparent. Everything below outlines the exact architecture of the app, described plainly enough to be verified, rather than taken on faith.
- Vault encryption
- AES-256-GCM, authenticated. Your data is encrypted with a master key, and that master key is itself encrypted by a key derived from how you unlock. Changing your password re-wraps the master key rather than re-encrypting everything you own.
- Password-protected exports
- When you put a password on an export, the key is stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations rather than used directly. Files below 100,000 iterations are refused on import.
- Where the key lives
- It depends on how you unlock. Under device security, a random key is generated on your device and held in the iOS Keychain, released by Face ID or your passcode. Under a custom password there is no stored key at all: the password you type derives it at each unlock, and nothing goes to the Keychain. Either way it is never transmitted to us, because we run no server that could receive it.
- Key sync
- When device security is used, the key syncs through iCloud Keychain so you can unlock on your other devices, over a channel Apple end-to-end encrypts and we have no access to. A custom password never syncs, because it is never stored anywhere to sync. Instead, you enter it on each device.
- Data sync
- Off unless you enable it. When on, your cases sync through your personal iCloud account as ciphertext, encrypted on your device before it leaves. The key that opens it is not part of that data, and we are not in that path at any point.
- Unlocking
- Face ID, device passcode, or a custom password you set for the vault.
- Redaction
- Applied to the pixels before the image is written. There is no hidden layer to remove, and no copy underneath.
- Detection
- Names, dates, and similar details are proposed by on-device text recognition. It is a tool designed to assist you, not an exhaustive filter: nothing is actually removed until you confirm it.
What we cannot do
We cannot recover your data. That is the trade.
Because we never hold your key, there is no reset link and no support route back in. If you lose your credentials and your Recovery Code, the data is permanently gone. We cannot recover it for you. A vendor who can restore your access is a vendor who can read your files.