Our security model is built on the principle of Zero-Knowledge. We never see your data, and we never see your master password.
All data is encrypted with AES-256-GCM on your device before being transmitted.
We use PBKDF2 with 600,000 iterations to derive your encryption keys from your master password.
The server only ever sees the encrypted blobs. It has no way to decrypt them.
Every access to your vault is logged and can be audited by organization admins.
Your master password is the only key to your vault. It is never stored on our servers and never leaves your device. We use it to derive your encryption key locally. This means that if we were ever compromised, your data would remain encrypted and inaccessible to attackers.