Security architecture
CifraVault is built on a zero-trust security model. Every secret is encrypted at rest and in transit with defence-in-depth controls at every layer.
Zero-Plaintext Architecture
Secret content is never stored in plaintext. Encryption happens before persistence, and decryption happens only at the moment of authorised reveal.
AES-256-GCM Envelope Encryption
Each secret is encrypted with a unique data encryption key (DEK). The DEK itself is encrypted by an AWS KMS master key, creating a two-layer envelope.
AWS Key Management Service
Master keys are managed by AWS KMS within the European Union. Keys never leave the KMS boundary. CifraVault has no access to raw key material.
Automatic payload removal
For server-encrypted secrets, the stored payload is removed from object storage when the secret expires, reaches its view limit, is opened with burn-after-read enabled, or is deleted. For end-to-end encrypted secrets, the stored ciphertext is cleared only by burn and may remain after expiry, view exhaustion or deletion. Metadata and audit entries are retained in both cases, and attached files keep their own lifecycle.
Access Verification
Every secret reveal requires explicit verification. Choose from multiple OTP channels to match your security requirements.
Multi-Channel OTP
Email, SMS, and TOTP authenticator app. Each channel independently verified. Configurable per secret.
Rate Limiting & Brute Force Protection
Per-plan rate limits, OTP attempt counters, and automatic lockout after failed verification attempts.
Burn-after-read
With burn-after-read enabled, a secret's text payload is removed once its view limit is reached, and the text link stops working. Attached files are not affected: they keep their own expiry, access budget and revocation.
Audit & Compliance
Every operation generates an immutable audit record. Full traceability from creation to destruction.
Immutable Audit Trail
Request ID, timestamp, actor identity, action, and outcome recorded for every operation. Logs cannot be modified or deleted during retention period.
EU data storage
Secret content, encryption keys and audit logs are stored on infrastructure in the European Union. Content delivery and payment processing involve providers that also operate outside the EU under documented transfer safeguards; the Data Processing Agreement records each one.
Plan-Based Retention
Audit log retention follows your plan window as documented in our Data Retention Policy, with contract-based extensions available on Enterprise. Unresolved retention states fail safe — nothing is deleted until they are corrected.
Pre-Purge Safeguards
On Business and Enterprise plans, audit logs approaching the end of their retention window trigger an owner notification and a grace window, and the workspace owner can request an audit-log export before deletion proceeds. The export covers audit logs, not other product data.
What we do and don't claim
AES-256-GCM envelope encryption with AWS KMS
Zero-plaintext storage architecture
Immutable audit logging
OTP verification (email, SMS, TOTP)
EU data storage for secret content, keys and audit logs
API-first design with key authentication
Burn-after-read payload removal (text only)
Plan-based audit retention with Business/Enterprise pre-purge export
SOC 2 or ISO 27001 certificationNot claimed
Client-side file encryption
Zero-knowledge architectureNot claimed
Guaranteed SLA numbersNot claimed
Trusted-recipient directory or recipient allowlist enforcementNot claimed
LDAP/AD directory sync or recipient device bindingNot claimed