SAFE

How SAFE protects your data

Last updated: October 2026

In short

Everything you put in a vault is encrypted on your device before it is sent, and our servers keep data they have no key for. This page says how that works, what we can still see, what is not done yet, and how to report a flaw. It describes the code as it is today.

The encryption

  • Each vault has its own random 256-bit key. Items and files are encrypted with it using AES-256-GCM, with a fresh random value (IV) every time.
  • That key is locked separately by each way you can open the vault: its password, its recovery key, Face ID or Touch ID, or a code kept on one device.
  • Your vault password goes through Argon2id on your device (64 MiB of memory, 3 passes, a random salt per vault) to make the key that unlocks the vault key. We never receive the password.
  • The recovery key is 128 random bits, shown once when the vault is created. We keep no copy, which is why we cannot reset a forgotten password.

What our servers can see

  • Your email address, and the sign-in data of your account: sessions with their IP address, device description and dates.
  • For each item: its type (password, card, note...), its size, when it was created or changed, and whether it is a favourite. Not its title, its fields or its file names: those are encrypted.
  • The names and hints of your vaults. These are not encrypted, so keep them general.
  • Who a vault is shared with (their email addresses), and when an emergency contact asked for access.
  • Your plan and, if you pay, your Stripe customer number.

Sharing a vault and emergency access

  • To share a vault, your app locks its key with a new random key that only the link carries, after the # sign. Our servers keep the locked copy and never see the link's key.
  • The person signs in with the address you invited, unlocks the vault key in their own app and locks it again with a password of their own. The link then stops working.
  • For an emergency contact, our servers hold the locked copy back until they ask and the waiting time passes without you refusing. They hold the link, we hold the time lock: neither can open the vault alone.
  • Removing someone stops their access through SAFE. Anything they already saw, copied or exported stays with them, and the vault's key is not changed.

Your account

  • You sign in with your email and a password, confirmed by a code sent by email. Two-step sign-in with an authenticator app or an email code is in Settings.
  • You can see the devices signed in to your account and sign them out. SAFE emails you when a new device signs in.
  • Repeated requests are slowed down to stop guessing.

On your devices

  • A vault locks after 10 minutes without use, and a copied password is cleared from the clipboard after 45 seconds. You can change both.
  • In the iPhone app, Face ID keeps its key in the iOS Keychain, readable only on that phone while it is unlocked, and erased if the faces enrolled on the phone change.
  • A code that opens a vault stays on the device that set it. In the app it is sealed again with a key from the Keychain. On the website it is not, so someone who copies the browser's storage could try every code: that is why new vaults use a password by default.
  • The offline copy and "Keep open" on the website store only encrypted data on your device, and are cleared when you sign out.

Links, leak checks and the assistant

  • A shared link carries its own key after the # sign, a part browsers never send to our servers. Links expire after 7 days at most, and you can stop one at any time.
  • To check a password against known leaks, SAFE sends only the first 5 characters of its SHA-1 hash to Have I Been Pwned and compares the answer on your device.
  • The support assistant never receives what is in your vaults, only the questions you type.

Who hosts what

Encrypted data and files: Supabase, on servers in the European Union. Website: Netlify. Domain: Cloudflare. Emails: Brevo. Payments: Stripe, which never shares your card number with us. Support assistant: Anthropic.

What is not done yet

  • No outside firm has audited SAFE yet.
  • Two-step sign-in is checked by the app, not yet by the database itself. Your vault password still protects what is inside.
  • Certificate pinning is prepared for the iPhone app but not switched on yet.
  • While a vault is open in a browser, its key is in the page's memory, as in any web password manager. A strict Content Security Policy limits where code can come from and where data can go.
  • If you lose both a vault's password and its recovery key, nobody can open that vault, us included.

Report a flaw

Write to contact@online-safevault.com with what you found and how to reproduce it, and give us reasonable time to fix it before telling anyone else. Every real report gets an answer, a fix, and credit if you want it. Out of scope: automated scan noise, denial of service, social engineering, and attacks that need someone's unlocked device.