Vault Management

Your data is encrypted in your browser before being sent to our servers, so we only ever store ciphertext.

Your password is never stored. It's used to derive an encryption key using PBKDF2 with 100,000 iterations.

A random master key encrypts all your data. This key is itself encrypted with your password-derived key before storage.

In Sovereign mode, SORVA holds no key that can decrypt your vault — only your Vault Key and recovery phrase can. In Standard mode, we keep a sealed recovery key so we can help you reset access.