Security & architecture

Account-free mobile apps

The native apps do not require a Revault account, email address, password, or web sign-in. Vaults are created and encrypted on-device. Local vault use does not upload your files to Revault’s servers.

The native apps need no Revault account. Optional cloud sync uses your Apple or Google account; store purchases use the platform’s billing account.

Vault pattern

Each vault has a random 256-bit master key. Your 5 × 5 device pattern combines with a random 256-bit local secret; PBKDF2-HMAC-SHA-256 with 600,000 iterations and a fresh 128-bit salt derives the key that wraps that master key with AES-256-GCM.

Draw your pattern on the 5 × 5 grid to open its vault. Other vaults and their names stay out of view. Patterns must be different across vaults enrolled on the same device; choosing a pattern does not reveal which other vaults exist.

This pattern only unlocks this device. Keep your recovery key to set up another device.

Device-only key protection

On iOS, the local unlock secret is stored in a nonsynchronizing Keychain item accessible only while the device is unlocked. On Android, device unlock material is encrypted with a non-exportable Android Keystore key that requires an unlocked device.

Local unlock secrets are not included in native cloud sync or portable backups. The iOS secret is not a Secure Enclave key, and Android hardware backing depends on the device. Device protection does not make a predictable pattern safe after the local secret has been compromised.

Encrypted before upload

File contents, filenames, previews, vault names and folder structure are encrypted on-device. AES-256-GCM authenticates metadata and key wrappers; files use an AES-GCM-HKDF streaming format so encryption can process large files in bounded segments.

Local vaults keep encrypted files in private app storage. Taking a photo or video inside a vault uses private staging before encryption, rather than automatically saving a gallery copy. Importing an existing file does not remove its original from Photos or another provider.

Optional private cloud sync

iOS uses a private CloudKit database in iCloud. Android uses Google Drive’s private app storage. Files, names and previews are encrypted before transfer. Your cloud provider can still observe operational information such as sizes, identifiers and timestamps.

Sync is off by default and selected separately for each vault on each device. Turning it off stops further transfers from that device; it does not delete existing encrypted cloud copies. Connect another device on the same platform with the same native cloud account and the vault’s recovery key.

iCloud and Google Drive sync stay within their own platforms. Choose Revault Cloud for live iOS–Android sync, or use an encrypted phone transfer.

Pro storage for encrypted vaults across iOS and Android. Revault receives ciphertext, never your vault key or recovery phrase. Switching providers leaves previous cloud copies in place.

Automatic vault locking

The default timeout is 60 seconds. Choose 30 seconds, 1 minute, 2 minutes, 5 minutes or 10 minutes in that vault’s settings. Shared vaults use the 60-second default; background locking applies regardless of the selected timeout.

The mobile app locks immediately when backgrounded. Locking cancels vault work, clears decrypted file information and search state, cleans up temporary previews, and wipes owned key buffers. iOS also covers app-switcher snapshots; Android uses the operating system’s secure-window flag.

Managed memory and device storage cannot guarantee immediate forensic erasure of every copy. Automatic locking also cannot retract a file you have explicitly exported to another app.

Encrypted backups and recovery

A recovery key unlocks encrypted vault key material; it does not contain your files. A backup contains the encrypted files; it is not a substitute for keeping the recovery key. Store them separately and protect both from loss.

Save your recovery phrase during setup. Revault generates 18 random words, or you can choose and confirm your own phrase. It lets you enroll another device or restore a backup without your local pattern. You can replace it in vault settings; older backups can still require their original key. Existing hexadecimal keys remain valid. Revault does not keep a copy and cannot reset it for you.

Phone transfers create a fresh encrypted copy and a separate transfer key, including between iPhone and Android. The original remains on the old phone. Verify the receiving vault before removing old files, and keep independent backups because sync can propagate deletions.

Secure sharing

Your vault pattern, recovery key, and vault master key are never included in a share. The service receives encrypted file data and operational metadata such as sizes, checksums, timestamps, and access-session counts. The separate decryption secret is not uploaded.

Controlled shares use a server-enforced expiry and optional access-session limits, export restrictions and a timer after first access. iOS also supports private CloudKit invitations, which do not enforce those server controls. Recipients open an isolated shared vault using the separate secret, without your personal pattern.

Expiry and revocation stop future retrieval through Revault. They cannot erase screenshots, exported files, or copies retained by a recipient. Choose someone you trust, even when export is disabled.

Optional vault security controls

Safe Exit removes other vaults’ local access and data when a designated vault is opened. Cloud copies remain, and offline-only vaults can be lost without a separate backup. It is not guaranteed forensic erasure.

Activity history and break-in photo alerts are optional per vault. Device history and photos stay local and encrypted; controlled shares may separately record access-session timestamps. Break-in captures require camera permission and normal system indicators. Locked capture uses a public encryption key; reviewing the photos still requires unlocking the vault.

A note about security

Local vault use does not upload files to Revault. Optional native sync exposes operational metadata to Apple or Google. Controlled sharing sends encrypted copies and access metadata to Revault, without uploading the separate decryption secret.

Malware, a compromised operating system or app, and someone viewing an unlocked screen can expose plaintext. Changing a pattern does not revoke another device, invalidate old backups or rotate the vault master key. If a vault key or recovery secret is compromised, move the files into a new vault with fresh keys.

Revault has not undergone an independent security audit. These are descriptions of the implemented cryptographic design, not a certification or a guarantee against every intrusion.