Hardware-Backed
SEP ECIES & Face ID wrap
The vault key is wrapped by a Secure Enclave P-256 identity. Face ID is required to unwrap it. The DEK never sits in the clear.
SecureVault
Your Private Vault, Isolated from the OS.
Photos, notes, and recordings stay sealed behind Face ID and the Secure Enclave. While locked, the device holds ciphertext only — never a readable copy iOS can browse, index, or snapshot.
Download on the
App Store
iPhone. Offline-first. No cloud vault.
Architecture
Isolated by design.
Four layers sit between your files and the rest of the device. Military-grade primitives, implemented so plaintext never has a home on disk.
In-Memory Streaming
No plaintext written to disk
Voice and media are encrypted as they arrive. Ciphertext is appended in place. APFS never sees the original bytes.
Zero Plaintext on Disk
Ciphertext only while locked
When the vault is locked, the device holds sealed AES-256-GCM blobs. There is nothing for the OS to index or preview.
Snapshot Shield
App Switcher leak protection
Before iOS snapshots the window, a full-screen shield covers decrypted photos so the App Switcher cannot leak them.