SECURITY / TRUST THROUGH TRANSPARENCY
Trust needs
something to stand on.
See how Cryptex Vault protects your data, where that protection ends, and what we're doing to improve its security.
01 / SECURITY STATUS
The current picture.
Algorithm names are only part of the story. Implementation, protocol design and independent scrutiny matter.
Independent security audit
Not yet completedIndependent review is part of the security roadmap.
Internal red-team testing
PerformedWe have conducted thorough internal red-team testing, and we recognize that it does not replace an independent audit.
Source code
Public repository - AGPL-3.0The source code is public. You can inspect the implementation, build the software, and follow development on GitHub.
Responsible disclosure
Public policyPrivate reports receive a first response within 3 working days.
02 / THE SECURITY BOUNDARY
Encryption has a boundary.
Your device is part of it.
Cryptex Vault protects stored and synchronized data. It cannot secure an unlocked vault on a compromised device.
WHAT THE DESIGN PROTECTS
Vault storage and data in transit.
Your vault is encrypted on your device before it is stored or backed up. When linked devices sync, post-quantum cryptography helps them confirm each other's identity and establish a secure session. Vault data then travels between them in end-to-end encrypted messages, even when a TURN server relays the connection.
Cryptex Vault's signaling servers and TURN relays help devices connect. Managed backup storage holds encrypted vault copies. None of these services receives plaintext passwords, plaintext vault contents or decryption keys.
Read the sync guide for the connection flow and the cryptography guide for the algorithms and keys.
WHAT IT DOES NOT PROTECT
A compromised, unlocked device.
While the vault is unlocked, your browser and operating system need access to its data. A compromised device may expose that unlocked data, so keeping your device, browser and extensions up to date remains important.
Revoking Online Services permissions does not remotely erase a local vault. Keep a backup and its recovery information somewhere safe and separate from your devices. If every device is lost or wiped, you will need both to restore your vault.
03 / INFRASTRUCTURE VISIBILITY
Encrypted content.
Observable connections.
If you use only the local vault, Cryptex Industries does not receive connection setup metadata. If you choose Online Services, its synchronization, backup and account systems process the limited service data listed below.
Signaling
Connection setupOpaque SyncIDs, channel names, presence identifiers, connection timing and WebRTC SDP/ICE information, including IP addresses, ports and network paths.
STUN / TURN
Network metadataNetwork addresses, connection metadata and, for relayed connections, encrypted traffic.
Managed backups
Encrypted copiesAn encrypted vault copy in managed storage. Backup retrieval and vault recovery are separate mechanisms.
Business operations
Service-related dataPayment, subscription, support and operational data are handled separately from encrypted vault contents.
04 / RESPONSIBLE DISCLOSURE
Found something?
Tell us privately.
Send a summary, affected version, reproduction steps and a minimal proof of concept using your own test data. Please don’t publish vulnerabilities in GitHub Issues.
Email the security team