Security by Mathematics. Not by Trust.
OneVault is designed with zero-knowledge cryptography at its foundational layer. Even in the event of a total server breach or government subpoena, your data remains impenetrable ciphertext.
Argon2id Master Key Derivation
Your master encryption key is derived directly on your client device from your PIN/password and a cryptographically random 256-bit salt using memory-hard Argon2id parameters (time cost: 3, memory cost: 64MB). Raw passwords are never transmitted or hashed on the server.
AES-256-GCM Authenticated Encryption
All documents, form-filler fields, notes, and file attachments are encrypted with Authenticated Galois/Counter Mode (GCM). This mathematically guarantees both confidentiality and ciphertext tamper resistance.
Zero-Knowledge Object Storage (OV-ZKOS)
When syncing with the cloud, documents are sliced into 5MB encrypted binary blobs. The object store (S3/MinIO) receives only random-looking opaque ciphertext chunks. Filenames, tags, and document contents are strictly invisible to cloud servers.
Local-First SQLite Enclave
On mobile and desktop apps, data is stored in a locally encrypted SQLite database protected by OS biometric secure hardware (Apple Keychain / Android Keystore / Linux Secret Service).
Threat Model & Attack Surface
How OneVault compares against conventional cloud document storage providers.
| Security Vector | OneVault Architecture | Standard Cloud Drives (Drive/Dropbox) |
|---|---|---|
| Master Encryption Key | Derived in Client RAM only (Zero-Knowledge) | Held in Cloud Provider Key Vaults |
| Object Store Ciphertext | Opaque 5MB chunked blobs (Undecipherable) | Plaintext files scanned for AI indexing |
| Rogue Employee / Insider Breach | Mathematically Impossible to read data | Vulnerable to internal administrator access |
| Local-First Offline Access | 100% Free Forever without network dependency | Requires active connection & auth refresh |