"Zero-knowledge" is easy to put on a homepage. This page exists so it's not just a phrase — including the parts of our security story that are still in progress, not finished.
Your master password, your vault contents, and every record inside it are encrypted on your own device before anything ever reaches us — using Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption. Even the optional encrypted cloud backup only ever stores bytes we cannot decrypt. There is no master key, no admin override, no "we promise not to look." We built it so there is nothing to look at.
We would comply with a valid legal order the same as any company has to. What we could actually hand over is limited by what we actually hold: account metadata (your email, order history, license status) — never your vault contents, because we never had them in readable form to begin with. A court order can't extract what was never on our servers.
Honestly: Vaultherit has not yet commissioned a formal third-party penetration test or cryptographic audit. We're saying that here instead of letting the silence imply otherwise. The encryption choices themselves (Argon2id, XChaCha20-Poly1305) are widely-reviewed, standard, published algorithms — not something we invented ourselves — but an independent audit of our specific implementation is a real gap, and one we intend to close. We'll update this page the day it happens, with the report linked, not just a badge.
Off by default. Crash reporting only ever activates if you deliberately paste in your own project key — we don't collect usage analytics from inside the app unless you've explicitly turned something on yourself.
If you're a security researcher and find a genuine vulnerability, we want to hear about it directly, before it's public anywhere else: support@vaultherit.com. We don't have a formal bug-bounty program running yet — another thing on this page that's honestly a work in progress — but every real report gets a real response from an actual person.
This page is the honesty statement. The technical page explains exactly how the encryption works.
Free lets you explore every category and start with 3 record types, no card needed. Worth trying before you decide.
Get Vaultherit Free