Docs / Security
Security
Vaultron keeps your data on your device and in your own iCloud. There is no Vaultron server. This page explains how the protection works and where its limits are.
On the device
- Encryption. Files, thumbnails, names, folders and the vault list are encrypted with AES-256-GCM. The keys are never written to the file system.
- Keys from your pattern. Each pattern is turned into a key with PBKDF2-HMAC-SHA256 at 600,000 iterations. A device secret is added to that key. The device secret is stored in the iOS Keychain, on this device only.
- Hardware protection, not the Secure Enclave. Keys are protected by Apple’s Data Protection, which uses the device’s hardware encryption. Vaultron does not use the Secure Enclave for its keys.
- Lock screen. The lock screen shows only the pattern grid and Trouble getting in?. A wrong pattern shows the same message whether or not a vault exists, and the help screen looks the same whether or not any vault exists. See Trouble getting in?.
- Screenshots, screen recording and the app switcher. With Protect against screenshots and screen recording (on by default), the library (including a shared vault you received), the viewer (photos, videos, documents) and notes are drawn in a layer iOS leaves out of screenshots, recordings, mirroring and AirPlay, so they come out black; on your screen they work as usual. A cover is also shown while the screen is recorded, mirrored or shown over AirPlay, and Vaultron is always covered in the app switcher. After a screenshot in an open vault, a short notice says whether vault content was left out (Notice after a screenshot, on by default). iOS does not let apps stop a screenshot from being taken, and some screens are not hidden: screens without vault content (Settings, the lock screen, the welcome tour, the Pro screen), sheets such as Move, Arrange and Create share link (which can show folder names), the preview when you press and hold a thumbnail, the status bar, and system screens such as the keyboard (including its word suggestions), the share sheet, the Photos picker, the camera and the full-screen video player if you expand a video.
- Deleting originals after import. Off by default. When it is on, an original is deleted only after its encrypted copy has been read back from the vault and its SHA-256 checksum matches what was imported, and only after Vaultron has asked. See Deleting the originals.
- Vault type stays hidden. Settings never shows whether a vault is standard, decoy or duress; you can only set a new type.
Backups
- Backups go to your private iCloud database.
- Each backup is sealed to your 24-word recovery phrase with HPKE (X25519, HKDF-SHA256 and ChaCha20-Poly1305). Without the phrase, the backup cannot be opened.
- Vaultron keeps no copy of the recovery phrase and never receives it.
- You can change the recovery phrase at any time. The change runs in two steps, so a backup is always readable with either the old or the new phrase, even after a crash. See Backup and recovery.
Sharing
Shared files are encrypted with a passphrase of six generated words. Each shared item is encrypted again under a new key, and location, camera and date details are removed from photos and videos. Documents are shared as they are. The share controls (expiry, open limit, export) are enforced by the recipient’s app. They are not enforced by cryptography. See Sharing.
Error reports
- Settings → Diagnostics → Share errors anonymously is on by default. If you never changed it in an earlier version, it is now on; if you turned it off, it stays off.
- When it is on, Vaultron keeps the error reports iOS gives it (crashes, hangs, and heavy CPU, disk-write or launch-time use) on this device, up to 20. A report holds only the app and iOS version, the device model and processor type, the type of error, timings, and where in Vaultron’s code it happened; dates are cut to the day. Never your files, notes, names, location, or any account or device ID.
- Nothing leaves this device until you send it. You can read the reports in Error reports, exactly as they are stored, and send them yourself with Send to support, which opens an email draft from your own account with the reports attached (or the share sheet if Mail is not set up). The email shows your address to support; the reports themselves carry no identifier.
- Turning the setting off deletes the stored reports.
Who it protects against
| Situation | What Vaultron does |
|---|---|
| Someone holding your unlocked phone for a moment | By default, the app locks as soon as it leaves the foreground (Auto-lock can be set to 1 or 5 minutes), and the app switcher shows no content. |
| Someone snatching your phone while a vault is open | Shake to lock (on by default): the sudden jerk locks the vault at once, behind a cover, and drops its keys from memory. |
| Someone copying the device’s storage without the Keychain | Everything in the app container is encrypted. |
| Someone forcing you to unlock | Each pattern opens a different vault. The duress vault removes the other vaults from the device. See Vaults and duress. |
| Apple or iCloud reading your backup | The backup records hold only encrypted data, sealed to your recovery phrase. |
| Thundera | Vaultron has no server. Thundera never receives your files, keys, patterns or recovery phrase. |
Limits
- Short patterns are easier to guess for someone who has extracted both the device’s storage and its Keychain. Choose a longer pattern.
- Out of scope: a compromised or jailbroken operating system, malware running inside Vaultron, screenshots or screen recordings you make yourself, and someone watching you draw the pattern.
- Pro sync keeps the recovery private key wrapped under your standard vault keys. If someone extracts the device’s Keychain, cracks one pattern, and also has your iCloud records, they could open the backed-up vaults.
- Shared-vault rules are enforced by the app, not by cryptography.
- Notes and the keyboard. The iOS keyboard may learn words you type in a note (autocorrection and predictive text). Vaultron does not control this.
- Deleted data can remain physically in flash storage as ciphertext. Its keys are removed, so it cannot be opened.
- Shake to lock needs a sharp movement. Someone who takes the device slowly and smoothly does not trigger it, and on High sensitivity, running with the device in hand can lock it.
- No independent audit. Vaultron has not had an independent cryptographic audit.
Questions and reports
For support and questions, see Vaultron support. What is stored where, and how privacy rights apply: Privacy & GDPR/LGPD.