What we guarantee,
and what we cannot.

This page is written for someone who wants to verify, not for someone who only wants to be reassured.

At a glance

Four numbers that say the most about how the vault is built.

AES-256 GCM, authenticated, in 4 MiB chunks

Argon2id 64 MiB memory, 3 passes

0 keys on our server; we cannot open anything

TLS 1.3 HSTS with preload, no plaintext path

How the keys are computed

password → Argon2id(64 MiB, t=3) → master key
                                     ├─ HKDF "auth" → proof for the server
                                     └─ HKDF "kek"  → unwraps the vault key

The server receives only the first branch and hashes it again, with Argon2id, before storing it. The password cannot be derived from it. The second branch cannot be derived from it. So a full database breach yields no reusable secret and opens no vault.

The vault key is generated randomly in the browser at sign-up and wrapped separately with your password and with your backup code. Each file has its own key, wrapped with the vault key. That is why changing your password rewrites 32 bytes, not terabytes.

The parameters, so you can compare

What	How	Why this way
Key derivation	Argon2id, 64 MiB, 3 passes, 16 byte salt	Large memory makes GPU attacks expensive. Argon2id, not Argon2i, for side-channel resistance.
Content encryption	AES-256-GCM, 4 MiB chunks	GCM authenticates, not just encrypts. A modified chunk is rejected, not decrypted.
Nonce	8 random bytes plus a 4 byte counter	Never repeats under the same key, and chunks can be fetched in any order.
Chunk order	authenticated in each chunk tag	Reordering or truncating the file fails decryption rather than passing unnoticed.
Integrity	SHA-256, recomputed on every download	Not MD5 and not SHA-1: broken since 2004 and 2017.
Transport	TLS 1.3, HSTS with preload	No plaintext variant, not even for redirects.

Deletion destroys the key, not just the files

When you request account deletion, we first delete the wrapped key. From that moment the data is mathematically unrecoverable, including for you. You receive a deletion certificate. Encrypted blocks are physically removed from disk within 7 days.

The order matters. If the process is interrupted after the first step, deletion is already effective.

The limit we cannot eliminate

The encryption runs in the JavaScript we deliver to you, through the browser. If we were legally compelled or compromised, we could in theory deliver a modified version that transmits your password at your next sign-in.

No web architecture eliminates this risk entirely. Any service claiming otherwise is misinforming you, and it is worth asking them how.

What we do about it:

we publish the cryptographic digests of the code bundles, in a signed file;
we use Subresource Integrity, so the browser refuses a modified bundle;
reproducible builds with a lockfile, so anyone can rebuild and compare;
the code performing the encryption is public.

And an honest recommendation: for the most sensitive material, encrypt locally with an independent tool such as VeraCrypt or age, and upload the result. A service that tells you not to depend on it alone is a service you can trust.

Reporting a problem

If you find a vulnerability, write to security@amprentadigitala.ro. We reply within 5 working days at most. We have no bounty programme, but we do not send lawyers after researchers, and your contribution is credited if you want it to be.

Machine readable contact details are in /.well-known/security.txt.

What we guarantee,and what we cannot.