Security

What we can see. What we genuinely cannot.

This page is written for whoever has to answer “is it safe for us to use this.” If that question is coming from a SOC 2, ISO 27001, or Cyber Essentials review - or from a client asking how your agency handles their credentials - this is the page to send them. For the data-protection and legal side, see our privacy policy and GDPR page.

The threat model

If our database were copied in full, here's what an attacker would actually get.

Every secret and document is encrypted inside your browser, against your organization's own key pair, before it's ever transmitted. The private half of that key pair is itself encrypted at rest, under a key derived from your organization's recovery key - generated locally at setup and shown to you exactly once. We never receive or store that recovery key, and there is no master key, support-tooling backdoor, or code path anywhere in the system that decrypts your content on our infrastructure - not for us, not under a court order, not for anyone.

What we cannot see, ever

The plaintext content of any secret
The plaintext content of any document
Your organization's recovery key

What we can see (metadata only)

Who created a request, and who it was addressed to
When something was claimed, viewed, or destroyed
Operational facts that power the audit log below - never content itself

Two-factor authentication

Enforced, not optional.

Mandatory enrollmentEvery account requires a TOTP authenticator code, with no way to opt out or skip enrollment - for every user, from their very first login.

Required again for sensitive actionsA fresh code is required beyond the login session before creating a request, viewing a submitted secret, deleting something, or changing account security settings.

Anti-replay and lockoutOnce a code has been accepted for one action, that exact code is rejected if submitted again. Five incorrect attempts locks the account's two-factor check temporarily, closing off brute-force guessing.

Access & abuse controls

Isolated, audited, and rate-limited.

Strict tenant isolationAccess to a vault, request, or share is scoped to the organization that owns it at every layer, not just in the UI. Reaching another organization's resource fails the same way whether it belongs to someone else, is in the wrong state, or was never there at all - so a caller can never learn what exists elsewhere.

A real audit trailOrganization admins can see a full audit log of activity in their own organization - every request, claim, save, and destruction, with who and when attached. Metadata only, never secret content. Retention scales with your plan (see pricing), then automatically purged.

Rate limiting on every entry pointLogin, two-factor codes, account recovery, and public submission endpoints are all protected by rate limiting, so a single client can't brute-force a password, hammer a two-factor code, or spam a public request link.

User access

Access you can revoke one person at a time.

The organization's shared recovery key is the baseline every account starts with. Individual keys are the finer-grained layer on top of it, for exactly the case a compliance review usually asks about: proving you can cut off one specific person's access without disrupting anyone else's.

Individual keys, admin-grantedBeyond the organization's shared recovery key, any user can set up their own personal keypair. An admin then wraps the organization's private key to that specific person's public key, client-side, to grant it - the server never sees the unwrapped key at any point in that exchange.

Revocation scoped to one personAn admin can revoke a single user's individual access at any time - instantly, and with zero effect on the shared recovery key or on any other user's access. No blast-radius-wide key rotation required for what should be a one-person action.

Removal is anonymization, not deletionRemoving someone from the organization blocks their login, revokes any active individual grant, and anonymizes their personal data - the row itself is never deleted, so the audit log and any resource they once owned stay intact and attributable.

Closure & erasure

Reviewed by a person, never fully automated.

Account and organization closure requests are reviewed and completed by a person - see the “right to erasure” section of our GDPR page for exactly what that involves, including how it differs depending on whether you're your organization's sole admin.

Where things run

EU-hosted infrastructure.

Our primary infrastructure - file storage and, in production, email delivery - is hosted in the EU (Ireland). A small number of infrastructure providers we rely on for anti-abuse and account-security checks are based outside the UK/EEA; where that's the case, we rely on their own standard safeguards (such as standard contractual clauses) for the transfer.

Found something?

Report a vulnerability.

If you believe you've found a security issue, contact us and select “Security & privacy” as the reason - please include enough detail to reproduce it. We read every message ourselves and treat security reports as a priority, not a queue.

Ready to see it in your own workflow?

Set up your organization in a couple of minutes - no credit card, no catch.

Create organization