Encryption on the device: how Vaultopaz protects files
Everything you put in a vault is encrypted on your phone before it is stored. The keys are protected by the hardware keystore in the phone, and the app never sends anything over the internet.
What does on-device encryption mean?
On-device encryption means your files are locked on the phone itself, before they are written to storage, and the key never leaves the phone. There is no server that holds a copy and no account that can reset it.
How Vaultopaz does it
- AES-256-GCM encrypts your files, notes and their details.
- Argon2id turns your secret into a key in a way that is slow to guess.
- The hardware keystore of your phone (TEE or StrongBox) wraps that key, so it stays tied to this phone.
Vaultopaz has no internet permission. It cannot upload anything, and there is no cloud copy that someone else could reach.
What this protects against
If someone takes your phone or copies its storage, they find encrypted data. To open a vault, they need the right pattern on that same phone.
Good to know: the limits
- The phone must have a hardware-backed keystore (TEE or StrongBox). Without it the app refuses to create a vault.
- Android 10 or newer.
- The app has not had an independent security review yet.
Frequently asked questions
Which encryption does Vaultopaz use?
Files, notes and their details are encrypted with AES-256-GCM. Keys are derived with Argon2id and wrapped by the phone's hardware-backed keystore.
Does any data leave my phone?
No. The app has no internet permission, no servers and no analytics. The only way data leaves is a file you export yourself.
Why does the app need a hardware keystore?
The hardware keystore keeps the wrapping key inside a protected part of the phone. Without it the key would be much easier to copy, so the app refuses to start a vault.