Your security, non-negotiable.
Your financial data is protected with the same standards used by the world's best banks. No compromises, no shortcuts.
Layered encryption
Each layer of your information has its own protection system. Encrypting just one thing isn't enough.
Passwords hashed with bcrypt
Your password is never stored in plain text. We use bcrypt with factor ≥12 — even if someone accessed our database, they couldn't crack them.
bcrypt · factor 12+ · random salt per userTraffic encrypted with TLS 1.3
Everything traveling between your device and our servers is encrypted with TLS 1.3. We don't support older versions (TLS 1.0/1.1) or weak cipher suites.
TLS 1.3 · HSTS · Perfect Forward SecrecyData at rest with AES-256-GCM
All sensitive information in our database is encrypted with AES-256-GCM, the standard used in banking and military. GCM includes integrity verification.
AES-256-GCM · unique IV per record · HMACVault with double-layer encryption
Your password vault has an additional PIN that generates an independent encryption key. Even we can't see your content without that PIN.
PIN-derived key · PBKDF2 · zero-knowledge vaultJWT tokens signed asymmetrically
Session tokens use RS256 (RSA + SHA-256). The private key only lives on our servers — it never leaves. Access tokens last 1 hour; refresh tokens, 30 days.
JWT RS256 · access 1h · refresh 30d with rotationRobust authentication
Multiple verification layers so only you can get in.
Two-factor authentication (2FA)
Standard TOTP compatible with Google Authenticator, Authy, and any authenticator app. When enabled, even with your correct password, no one else can get in.
Automatic token rotation
Every time you use your refresh token to get a new one, the previous one is instantly invalidated. If someone intercepts a token, they only have a very short window.
Suspicious reuse detection
If we detect a refresh token being used twice (a sign of theft), we automatically block the entire session and notify you.
Rate limiting by IP and account
Maximum 5 login attempts per minute per IP. After that, progressive temporary blocking. Automatic protection against brute force attacks.
Redis blacklist of revoked tokens
When you log out, your token is immediately added to a Redis blacklist. There's no possibility of it being used again even if someone has it.
Invisible reCAPTCHA v3
All authentication forms have Google's reCAPTCHA v3. No annoying image puzzles — it works in the background and automatically blocks bots.
Intelligent password vault
The safest place for your passwords, cards, documents, and sensitive notes. With a unique feature you won't find anywhere else.
Emergency PIN (duress PIN)
If someone forces you to open your vault, use the emergency PIN. You'll see a fake version of your data — invented credentials, fictional balances — completely indistinguishable from the real thing.
Local encryption before sending
Your PIN generates an encryption key on your device before data leaves. Our servers store data they can't decrypt without your PIN.
Share with expiration
Share credentials securely with a link that automatically expires. You can choose how many times it can be viewed and when it expires.
Audit log of every access
Every time a vault item is viewed, created, modified, or shared, it's logged with date, time, IP, and device.
Categories: passwords, cards, docs, notes
Organize all types of sensitive information. Credit cards, ID documents, WiFi passwords, encrypted notes — all in one secure place.
Password health check
Detects weak, repeated, or compromised passwords in known breach databases (HaveIBeenPwned), and suggests improvements.
Trustworthy infrastructure
Our own servers in Europe, not on third-party public cloud.
Dedicated VPS at OVH Europe
Ubuntu 24.04 LTS · OpenLiteSpeed · we don't share servers with other customers
MariaDB with encryption at rest
Database with full disk encryption and daily encrypted backups
Redis for sessions and rate limiting
Automatic TTL on tokens · in-memory blacklist · <1ms latency
Automatic daily backups
Encrypted backups retained 30 days · restoration in minutes
CDN for static assets
Images, scripts, and styles served from global edge nodes
24/7 monitoring
Automatic alerts on anomalies · response time <5 min
Your privacy, by design
Security isn't just about encryption — it's also about how we treat your information.
We never sell, rent, or share your data with third parties.
We don't use your financial data to train external AI models.
You can export or delete all your information at any time.
Audit logs are accessible to you — not just to us.
We comply with OWASP Top 10 best practices.
We never store passwords in plain text, even in logs.