Pattern + device
Argon2id stretches the pattern. A device-only Keychain secret, protected by required system authentication, works alongside it.
PRIVATE FILES. ON YOUR IPHONE.
Privacy, explained.
Limits, included.
Trust deserves more than a lock icon. Here’s how Vault protects your files, how you regain access, and where the protection stops.
01 / LAYERS OF PROTECTION
Your files have a home.
Access has its own protection.
The pattern selects a vault. Protected keys unlock it. Authenticated encryption guards its contents.
Independent keys
Each vault has a random 256-bit master key, with separate pattern and recovery wrappers and per-file key separation.
Authenticated encryption
AES-256-GCM protects file chunks and the metadata index. Authentication checks reject modified content.
The technical details
Pattern derivation uses Argon2id13 with three operations, 64 MiB of memory and a 16-byte salt. Its output is combined with a random 32-byte device secret using HMAC-SHA256; domain-separated HKDF-SHA256 derives the wrapping keys.
The Keychain item is device-only, non-synchronising and accessible only with a device passcode set, under user-presence access control. Face ID, Touch ID or the iPhone passcode can satisfy system authentication. This is Keychain protection, not a claim that the symmetric keys live inside Secure Enclave.
Files use authenticated chunks of up to 1 MiB. Associated data binds content to the file identity, expected byte count and chunk position. The complete metadata index is also authenticated and encrypted. Real-device latency and performance still require measurement.
02 / THE PROTECTION BOUNDARY
What’s protected.
What stays outside.
Your dataHow Vault treats it
Saved camera capturesEncrypted inside the open vault without creating a Photos library copy. Capture hardware validation remains release work.
Imported filesEncrypted and authenticated in chunks inside Vault’s local storage.
Filenames, types, dates & byte countsStored in the encrypted, authenticated metadata index.
Patterns & recovery wordsNot persisted by the app. Transient setup state is cleared on commit, cancellation or background locking.
Recovery-word entryUses the iPhone’s system keyboard. Third-party keyboards are blocked throughout Vault, including while recovery words are revealed for editing.
App-managed photo thumbnailsGenerated on demand, cached only in memory and cleared on lock. System components may maintain their own caches.
Vault existence & storage sizeNot hidden from filesystem inspection. File sizes, timestamps and encrypted container count can remain visible.
Originals, previews & exportsOriginals stay unchanged outside Vault. Previews and exports temporarily become readable files with iOS file protection and cleanup. Delivered copies belong to the destination’s control.
PROTECTED KEYBOARD ENTRY
Recovery words stay
on the system keyboard.
Vault blocks third-party keyboard extensions throughout the app. The restriction stays active when you reveal recovery words to check or correct them.
This applies when recovering access, creating or verifying a backup, and restoring an archive. There’s nothing to switch on. Revealed words are still visible on your screen, so keep them out of view of others.
03 / TWO DIFFERENT SAFETY NETS
A way back in.
A copy kept elsewhere.
Recovery words restore access.
Each vault has 128 bits of independent random recovery material, encoded as 12 words. The words can unlock matching existing vault files without the original device secret. Recovery then requires a replacement pattern and new recovery words.
About recovery wordsEncrypted backups preserve a snapshot.
A manual archive uses separate encryption keys and contains the selected vault’s snapshot. Saved-copy verification authenticates the archive. Restore needs the archive’s original words and creates a fresh independent vault while preserving existing ones.
About encrypted backupsWords alone cannot recreate missing files. Keep a verified archive outside your iPhone, its matching words separately, and your originals wherever possible.
VAULT, UP CLOSE
3 APP SCREENSProtection you can see in the app.
Pattern access, verified backups and recovery, in the actual app preview.
iPhone 18 Pro · dark
Setup & access
Your pattern. Your space.
A familiar way back into your vault, followed by device authentication.
Backup & recovery
Keep a verified copy.
Create a manual encrypted snapshot, verify a saved archive, or plan a restore.
Backup & recovery
A second way back in.
Use matching recovery words to regain access to existing vault files.
Current app captures with sample files. Choose a device and appearance. Select a screen to take a closer look.
04 / CLEAR LIMITS, ALWAYS
Protection is specific.
So are its boundaries.
Knowing these limits is part of making an informed choice about your files.
An unlocked screen is an open screen.
Someone viewing your screen, a compromised operating system, or an attacker controlling the unlocked app can access information outside this protection boundary. The app assumes iOS and the device are operating normally.
Video is encrypted when you save.
Secure camera never writes to Photos. Photos stay in app memory until saved. Video uses a temporary MOV protected by iOS file protection before it passes through the vault’s encrypted import path. Temporary capture files are removed after saving or discarding, with a launch-time sweep for leftovers. This is not a guarantee of forensic erasure. Saved captures need a new manual backup.
Hidden vaults leave encrypted containers.
The app hides its vault catalog, not the existence of storage. Filesystem examination can reveal vault count, ciphertext sizes, timestamps and deletion artifacts. This is not strong cryptographic deniability.
Patterns can be observed or guessed.
Patterns are human secrets. There is no validated entropy score or hardware-enforced retry counter for custom patterns. If an attacker obtains the protected device secret, offline guessing becomes possible; Argon2id increases its cost.
Changed credentials do not revoke copied wrappers.
Changing a pattern or recovery words replaces the current access header but leaves the live master key unchanged. A retained old header with its matching credentials may still reveal that key. Full master-key rotation and snapshot rollback prevention are not implemented.
Deletion is not a promise of physical erasure.
Deletion and duress remove app-managed local data. They do not guarantee secure flash overwrite, remove external archives or exports, or erase device snapshots and forensic remnants. Recovery words alone cannot restore deleted files.
Independent review is still ahead.
Independent security review is pending. Physical-device authentication, provider interruption and cross-device recovery remain release validation work. Tests do not constitute certification. Keep originals and verified backups; do not rely on Vault for the only copy of important files.
Describes the implementation documented through 24 October 2026. This is a design explanation, not an independent audit or certification.
LESS PUBLIC. MORE PERSONAL.
Yours.
And yours alone.
A private home for your photos,
videos and files. On your iPhone.