How OutVault keeps your files private.
Every file is sealed on your device before it goes anywhere, and only your devices can open it — everything on this page follows from that.
What happens to a file you add
Three steps, in an order that matters: the lock comes first, on hardware you own.
Step 01
Sealed on your device
The moment a file enters the vault it is encrypted on your phone or computer. From then on it is unreadable without your keys — and your keys never leave you.
Step 02
Synced as unreadable data
What travels to our servers, and what rests on them, is sealed data. We store it and move it between your devices; opening it is not something our systems can do.
Step 03
Opened only on your devices
Your vault unlocks where your keys are — on your devices. There is no server-side door, because there is no server-side key.
In practice
What that means in practice
None of these are policies we ask you to trust. They are consequences of where the keys live.
A breach here exposes sealed data
If OutVault's servers were ever broken into, what the intruder carried away would be encrypted files without the keys to open them — unreadable to us, unreadable to them.
Nobody at OutVault can open your files
There is no admin view of a vault. No employee, no support tool, no server ever holds your keys, so no one here can read what you keep.
We can't hand over what we can't read
A request for your files — from anyone — can only be answered with sealed data, because sealed data is all that exists on our side.
What encryption cannot do
End-to-end encryption locks one door — the one between your files and everyone who isn't you. Three things live outside that door, and you should hear them from us.
A stolen device that's unlocked
Someone holding your phone with the vault open sees what you see — no encryption changes that. Keep your device's own screen lock on, set to lock quickly.
A passphrase that's easy to guess
Your passphrase is the key, and the lock is only as strong as the key is hard to guess. Make it long rather than clever — a few unrelated words you can remember.
A person you trust, passing it on
Once someone opens what you shared, encryption can't control what they do next. Share with people you trust, and turn a link off once it has done its job.
Read more
- BlogEnd-to-End Encryption, Explained for Normal People
- HelpCan OutVault read my files?
- HelpDoes OutVault work offline?
A full technical write-up of the encryption design ships as the app reaches public release.