A card photograph can reveal more than you intended to save. Revault gives personal records an encrypted home; it is a document vault, not a payment wallet or a service for storing customers’ card details.
Save less sensitive information
Start with the smallest useful record: your issuer’s name, its support contact, and the last four digits may be enough to identify a card. Redact unnecessary numbers before importing statements or photographs. Avoid keeping a PIN or security code alongside the card. Encryption protects a saved file; reducing what you save also reduces what could be exposed.
Separate records from payments
Use your bank’s app or a supported payment wallet to make payments. Revault does not tokenize cards or replace your issuer’s fraud controls. Merchants handling customers’ payment details have separate PCI DSS obligations, including restrictions on retaining verification codes after authorization. A personal encrypted vault is not a claim of PCI compliance or a replacement for a payment processor.
Your vault. Your key.
Revault encrypts file contents, names, and previews in your browser before uploading them. The service can still observe account associations, object counts, sizes, and timestamps. Encryption does not make every part of using a cloud service invisible.
Revault’s native iOS and Android apps require no Revault account. Vaults stay on-device unless you enable private iCloud or Google Drive sync, create an encrypted share, or explicitly export them. The web app uses a separate passkey account and cloud. Encrypted backups move vaults between them.
A vault is only one part of a private life. Keep your devices updated, review browser extensions, and lock your screen. A compromised device or malicious frontend can read information while a vault is unlocked.
Vault security & backups
Your recovery key independently unlocks the master key of a vault. It is a secret: anyone who obtains it and the vault’s encrypted key material can attempt to open that vault. Save it as carefully as you would save a valuable physical key.
Keep an encrypted backup outside this browser, and periodically validate a restore. Browser storage can be evicted, and clearing browser data removes cached encrypted files. An installed PWA is a convenient app experience, not a guarantee of permanent storage.