Encrypted secrets
OAuth tokens, personal tokens, purchase codes, and provider credentials use authenticated AES-256-GCM encryption.
Security model
Clear controls, honest language.
Security is implemented in application boundaries, credential handling, storage access, and operational logs rather than marketing claims.
Storage isolated from the public web
Archives are written outside publicly served directories or to private cloud objects. Every retrieval verifies the signed-in account before bytes are streamed.
Authenticated downloads
No permanent public vault URLs are exposed. Every download confirms the current user owns the record.
Integrity records
Each stored source archive is recorded with a SHA-256 checksum and exact byte size.
Audit trail
Sensitive administrative and account actions are recorded with actor, time, target, and request address.
Session protection
Opaque session tokens are stored as hashes, delivered through secure HttpOnly cookies, and expire automatically.