Security

Veylux is built so that we cannot read your data even if we wanted to. This page summarises what is protected, how, and what is not.

What protects your data

• Each file is encrypted with its own random 256-bit key (AES-256-GCM) in 1 MiB authenticated chunks. Modified, truncated, reordered or swapped chunks are detected.
• File names, folders, tags and dates are stored in encrypted records. There is no plaintext database or search index.
• Your master password goes through Argon2id (64 MiB, 3 passes) to unwrap a random master key. Changing the password does not re-encrypt your files.
• A 256-bit recovery key is an independent way in. We never store it.
• Face ID, Touch ID and the PIN are device-only shortcuts. The PIN is tied to a secret in the Keychain and erased after five wrong attempts.

Verifiable claims

• The storage format is documented byte by byte.
• A small independent decoder written only from that documentation opens a test vault with the password or the recovery key.
• Veylux has no accounts, no servers, no analytics and no advertising SDKs. The only third-party code is the reference Argon2 implementation.

What it does not protect against

• A device that is already compromised, or someone who learns your password or recovery key.
• Someone who forces you to unlock the app. The decoy space is not plausible deniability.
• Screenshots and screen recordings made while the vault is open.
• Rollback of your files to an older valid state by whoever controls your storage.

Independent review

Veylux has not been audited by an independent third party. If you are a cryptographer or security researcher and would like to review it, write to [email protected].