File 004 · Controls on Record
What a breach exposes. What a court gets.
If our servers were breached, or we were served with a legal demand, the haul would be locked keys and account records, and none of your files or notes. This page lists every control behind that, everything we hold, and what isn’t covered. We have no certificates to show you yet.
Last updated: September 2026 · Written by humans.
§ 01 · Security Controls
Built to hold when the perimeter fails.
Perimeter security decides who gets in: a login page, a firewall, an access rule. The controls below sit on the data itself, so your files and notes stay encrypted even when a server or a cloud account is breached. Each row names the mechanism and where the blueprint documents it:
| Control | Mechanism | Documented |
|---|---|---|
| Files and notes encrypted on your device | AES-256-GCM with a fresh key per file, before anything is stored; notes under the same account key | blueprint → |
| No usable key on our servers | Your account key is stored only locked, under your passphrase, your device’s secure unlock or a passkey on the web | blueprint → |
| No recovery path to attack | No master key, recovery code or help-desk reset exists on our side for anyone to steal or social-engineer | blueprint → |
| We don’t hold your files or notes | They live on your device or in your own storage; we never receive them, their names or your cloud logins | blueprint → |
| Confined cloud access | The app works inside its own folder in your storage and nowhere else | blueprint → |
| Tamper-evident storage | Every chunk and index is authenticated; an index rolled back to an older state is refused | blueprint → |
| Memory-hard key derivation | Argon2id (RFC 9106), 64 MiB of memory per guess | blueprint → |
§ 02 · What We Hold
Everything a breach of our servers could reach.
Sorted by where it lives, because that decides who could get to it. Nothing is left off:
On our servers · the full list
- Your sign-in identity: the provider and its account ID
- The name and email your provider reports — shown to you, used for nothing else
- Your account key, locked once per unlock method (ciphertext)
- Argon2id salt and settings (not secrets)
- A one-way passphrase proof, keyed with a secret kept outside the database
- Passkey public keys (not secrets either)
- Your passphrase hint, if you set one — in plain text
- Whether you locked your account, and when
- Your sessions and signed-in devices
- Short-lived sign-in state, swept within minutes
Never collected · by design
- Your files, or any byte of their contents
- Your notes, or any word of them
- Filenames and folder structure
- Your passphrase itself, plain or encrypted
- Your cloud storage logins
- Anything that unlocks your account key
- Analytics, crash reports or tracking data
On your devices and storage · not ours
- Files encrypted in place on your device, named with .uvault
- Your Encrypted Notes, on your device
- In a cloud vault: encrypted objects under random names, one encrypted index per device
- Encrypted Notes backups, if you connect a cloud
- A plaintext vault.json marker in a cloud vault, with no user data
§ 03 · Independent Review
Unaudited, for now. Documented in the open.
Open to inspection today
Every primitive is a published standard with public scrutiny behind it: AES-256-GCM, Argon2id (RFC 9106) and HKDF-SHA256. The design, known gaps included, is on the blueprint page, and the file format is documented.
No independent audit or certification has been published. Until one is, the published design is the evidence: every security claim on this site should trace back to it. If a report is published, it appears on this page first.
§ 04 · Data Protection Law
GDPR & DPDP: less held, less exposed.
We treat data minimization as a security control, not only a legal duty: our servers keep account records and locked keys, and none of your files or notes. Under India’s DPDP Act 2023 and the EU GDPR:
- Lawful basis & purpose: your sign-in identity is processed only to provide Unlike Vault to you. It isn’t used for anything else: not profiling, not advertising, not sale.
- Your rights: access, correction, erasure, portability and objection. The privacy policy explains how to exercise them, and deleting your account removes your rows.
- Data minimization: the inventory above is complete. Every field we don’t collect is one less thing an attacker could take.
- This website runs no trackers: no analytics, no ads, no third-party scripts.
§ 05 · Legal Demands
What a legal demand can reach.
We comply with legal process when it’s valid, and what it can obtain from us is the inventory above: your sign-in identity, the name and email your provider reported, your sessions and devices, your passphrase hint if you set one, and locked keys we can’t open. Your files and notes aren’t here to produce, and the keys stay locked: we have no master key.
Where our answer ends: a vault in your own cloud sits with that provider, so demands for it go to them, not us. There, a demand reaches ciphertext and the metadata listed on the blueprint, not your content. Files you haven’t put in a vault are ordinary files, as readable to that provider as they always were.
§ 06 · Vulnerability Reports
Security research is welcome here.
If you find a weakness in the design, the apps or this website, send the details to contact@adamanture.com. Every credible report gets a real look. We ask for time to ship a fix before you publish, and when the fix is out we’ll credit you by name, or leave you out if you’d rather.
Who else is involved
- Your sign-in provider (Google or Microsoft) — confirms who you are when you sign in, with your consent.
- Your storage provider (Google Drive, OneDrive or Dropbox), if you connect one — only with the access you approve, and you can withdraw it whenever you like.
- Hosting infrastructure — operates our account service, and holds nothing beyond the inventory above.