Security

1. On-device generation

Every one-time code is computed on your device from a secret that never leaves it in plaintext. Vaulty implements the TOTP and HOTP standards (RFC 6238 and RFC 4226) with SHA-1, SHA-256, and SHA-512, plus Steam Guard codes. No secret or code is ever sent to us or to any server.

2. Storage

• Secrets are stored in the Apple Keychain, backed by the device Secure Enclave, and are accessible only when the device is unlocked.
• On a single device (no sync), secrets use a this-device-only protection class — they are never included in unencrypted device backups.
• The app can be locked behind Face ID, Touch ID, or your device passcode, with a configurable auto-lock delay.

3. iCloud sync (Pro)

When you enable sync, secrets replicate through Apple's iCloud Keychain, which is end-to-end encrypted by Apple with keys held only by your trusted devices. We operate no servers in this path and have no ability to read your data.

4. Backups

• Manual backups are encrypted with AES-256-GCM. The key is derived from a password you choose using PBKDF2-HMAC-SHA256 with 600,000 iterations. Without that password the file cannot be opened — by anyone.
• Automatic backups (Pro) are encrypted on-device with a random 256-bit key stored in your iCloud Keychain, then written to your own iCloud Drive. We never hold the key.

5. Hidden vault

The optional hidden vault is protected by a separate password. We store only a PBKDF2 hash of that password (600,000 iterations) — never the password itself — and enforce rate-limiting with exponential lockout after repeated failed attempts.

6. No trackers, no analytics

Vaulty ships with no third-party analytics or advertising SDKs and makes no tracking network requests. The only outbound requests the app can make are optional favicon fetches to a service's own website (see the Privacy Policy), and Apple-operated iCloud/StoreKit traffic you control.

7. Clipboard and screenshots

Copied codes use a local-only clipboard entry that auto-expires after 30 seconds and is not shared to other devices via Handoff. The app obscures its contents in the app switcher so codes don't appear in the multitasking snapshot.

8. Responsible disclosure

Found a vulnerability? We appreciate responsible disclosure. Email vaulty@redstone.ltd with details and steps to reproduce, and please give us reasonable time to respond before any public disclosure.

9. A note on device security

Because Keychain data can survive app deletion, if you sell or give away a device, perform a full erase (Settings → General → Transfer or Reset) rather than only deleting Vaulty.