PRIVACY YOU CAN UNDERSTAND

A clear lock.
No vague promises.

Here is how the current Octoshield vault protects your files, where they live, and what you need to know before trusting it with your only copy.

Encryption for the files themselves

Every imported file uses AES-256-GCM authenticated encryption in 512 KB chunks. Each item has a separate key derived from a random 256-bit master key with HKDF-SHA256.

The index and thumbnails are encrypted too. Authentication is designed to detect tampered or truncated encrypted data.

A secret tied to your device

Choose a PIN, passphrase, pattern, or combination dial. PBKDF2-SHA256 stretches your secret and combines it with a random device key stored in this iPhone’s Keychain.

Failed attempts are throttled after five tries. Optional erase-after-ten-failures is a destructive setting in the app; enable it only if you understand the consequence.

Optional biometric unlock

Face ID or Touch ID uses a separate unlock key protected by the Keychain’s biometric access control. The biometric path is invalidated when enrollment changes.

Keep your chosen secret available. Biometric convenience is not a recovery service, and some system conditions still require secret entry.

Local storage, clear boundaries

Vault files are kept on the iPhone and excluded from iCloud and computer backups. The app does not upload vault contents to an Octoshield server.

Photos may retrieve iCloud originals when you import or review them. A vault import does not remove copies from Photos, Files, shared albums, or other services.

Protection while viewing

Videos use an in-memory decryptor. Other documents may need temporary decrypted preview files; the app removes its scratch files when previews close or the vault locks.

The app obscures the vault in the app switcher and during detected screen capture. iOS does not allow every screenshot to be blocked. Exports are outside vault protection.

The limits matter

There is no vault recovery service, recovery phrase, cloud sync, or automatic transfer. Forgetting the secret, uninstalling the app, or losing or replacing the device can mean losing your files.

Export and verify essential files before changing devices. Keep an independent backup of irreplaceable documents. These are implementation details, not a claim of an independent security audit.

Read the privacy policy →

THE OCTOSHIELD FIELD GUIDE