When building a digital vault, traditional architectures rely on client-server synchronization where user documents and keys reside in cloud databases. Vaulta was engineered under a radically different premise: zero-knowledge, on-device isolation.
The Core Principle: The Device is the Source of Truth
Every piece of data you create in Vaulta—whether it's an identity document scan, a master password, a bank card CVV, or a daily expense entry—is encrypted locally before being committed to persistent storage.
We use AES-256 encryption coupled with Hive CE, an encrypted NoSQL object database. The encryption key is generated on first launch using a secure cryptographic pseudo-random number generator (PRNG) and stored inside the operating system's hardware security module (Android Keystore / iOS Keychain).
Zero Server Storage: Vaulta's backend servers have no database of your items, no credentials table, and zero ability to decrypt your local vault.
Master PIN Protection & Salting
When you set up an App Lock PIN, Vaulta generates a cryptographically secure 128-bit random salt. The PIN and salt are passed through a memory-hard hashing function. Only the resulting hash and salt are stored.
When you type your PIN, the application calculates the hash and compares it in constant time to prevent timing attacks. Because the salt is unique to your device, rainbow table attacks are computationally infeasible.
Hardware Biometric Enclaves
When biometrics are enabled, Vaulta delegates authentication to the platform's BiometricPrompt (Android) or LocalAuthentication (iOS). Your fingerprint or Face ID geometry is processed exclusively inside the device's Secure Enclave/TEE. Vaulta only receives an authenticated token indicating success.
Why Client-Side Isolation Matters
Cloud breaches, credential stuffing, and data leaks happen every month across major web platforms. By keeping your data encrypted and isolated on your handset, Vaulta ensures that your private documents and financial flows remain entirely in your control.