Annual · 2026
Third-party penetration test
A leading offensive-security firm tests our apps, APIs, and infrastructure every year. The latest report is available under NDA to business customers.
Zero-knowledge
We can't read your vault — by design
Your master password never leaves your device and is never sent to our servers. It's used to derive the encryption keys that lock your vault locally, so everything we sync and store is already ciphertext.
That means a stolen server, a rogue employee, or a court order all hit the same wall: without your master password, your data is just unreadable noise. Zero-knowledge isn't a setting you turn on — it's the foundation Vaultkey is built on.
Keys derived on your device
Argon2id stretches your master password into encryption keys locally — never transmitted, never recoverable by us.
Encrypted before it syncs
Every item is sealed on-device, so what reaches our servers is ciphertext we have no way to open.
Encryption model
How your data is protected at every layer
Defense in depth, from the password in your head to the ciphertext on our servers. Each layer is independent, so one failing never exposes the next.
1. Master password & key derivation
Your master password is stretched with Argon2id — a memory-hard function that makes brute-force attacks impractical — to derive the keys that encrypt your vault, entirely on your device.
2. Vault encryption
Each item is encrypted with AES-256-GCM and XChaCha20-Poly1305 authenticated encryption, so tampering is detected and your data stays confidential and intact.
3. Encrypted transport
All sync traffic runs over TLS 1.3 with certificate pinning, protecting your already-encrypted vault in transit against interception and man-in-the-middle attacks.
4. Encrypted-at-rest storage
On our servers your vault is stored as ciphertext on hardware-encrypted volumes, isolated per account, with strict access controls and continuous monitoring.
Compliance
Certified against the standards that matter
We hold ourselves to the same frameworks our most security-conscious customers are required to meet — and we publish the proof.
SOC 2 Type II
ISO 27001
GDPR
CCPA
HIPAA ready
FIDO2 / WebAuthn
Independent audits
Verified by people who aren't us
Trust shouldn't rest on a marketing page. We invite external experts to break Vaultkey and publish what they find.
Continuous
Public bug bounty
Researchers are rewarded for responsibly disclosing vulnerabilities through our bug-bounty program, with critical findings triaged within 24 hours.
Open
Open cryptography
Our encryption design and client libraries are published for public review, so the security community can verify our claims line by line.
A track record you can audit
Vaultkey's security posture, by the numbers.
0Vault breaches, ever
<24hCritical bug triage
256-bitAES encryption
100%End-to-end encrypted
Put your trust to the test
Read our security whitepaper, talk to our team, or just create a free vault and see zero-knowledge encryption protecting your first login.