Sovereign Vault

How it locks

Everything in the vault is encrypted under a single 256-bit Vault Master Key, generated once and never written to disk in the clear — it exists only in memory for the duration of an unlocked session. That key is unlocked two independent ways: a daily PIN, combined with a secret bound to this specific device, or a master password that stands alone as a recovery route. Either path produces the same key; neither one by itself is enough to reconstruct it.

Two independent paths unwrap the same vault master key: the daily-use PIN path combines a PIN with a secret bound to this device, while the master-password path stands alone as a recovery route. Either one produces the same 256-bit key, which then encrypts everything else with AES-256-GCM.

The vault defends itself

Ten wrong PIN attempts in a row triggers a 24-hour lockout. Ten more triggers 72 hours. A third exhaustion doesn't lock the vault again — it destroys the keys. "Destroys" means deleting the handful of small key-material entries in secure storage, not overwriting the whole disk: without those few kilobytes, the ciphertext left behind is permanently unreadable, by anyone, including us. Authenticating with the master password clears an active lockout immediately, so a legitimate owner who triggers their own lockout isn't stuck waiting it out.

What it actually defends against

Scenario	Outcome
Laptop is lost, stolen, or accessed by someone without your PIN or master password	Defended
Vault files copied to another machine or a USB drive	Defended
Repeated PIN guesses through the app's own unlock screen	Defended
Someone who already knows your PIN or master password	Not defended
Malware already running on your unlocked session	Not defended

Full technical detail — Argon2id parameters, the physical-portability model, and the one known hardening gap we're tracking (a software-enforced lockout counter, not yet TPM-anchored) — is written up in the security architecture document.

Sealed sharing

A vault can be packaged into a single encrypted file — a random, meaningless name, sealed with a 6-digit PIN — and sent anywhere: email, cloud storage, a USB stick. Whatever carries it only ever sees ciphertext. Share the PIN a different way, over a call or a text, and it stays useless to anyone who only intercepted one of the two.

The person on the other end doesn't need to own Sovereign Vault. Sovereign Vault Opener is a free companion app: enter the PIN, choose a folder, done — no account, no purchase.

Download Sovereign Vault Opener — macOS, free

Privacy Policy

Effective date: 2026

Sovereign Vault collects no personal data, in any form, ever — this isn't a policy choice sitting on top of the app, it's a consequence of how it's built.

We collect nothing. No account, no name or email, no usage data, no crash reports.
We transmit nothing. The app makes zero outbound network calls. There is no server to send anything to.
We share nothing with third parties, because nothing is ever collected.
Everything you store stays on your device, encrypted under your own PIN and master password. We have no technical ability to access, reset, or recover it.

If this policy changes, the update will be posted at this same URL with a new effective date.

Support

Most questions answer themselves:

Forgot your PIN? Use your master password on the unlock screen — it clears a lockout and unlocks the vault directly.
Lost both your PIN and master password? There is no recovery path, by design — neither secret is ever stored anywhere that could reset it. That's what keeps the vault safe from everyone else, including us.

Anything else — a bug, a crash, a question this page doesn't cover: mnemomemory@proton.me

End User License Agreement

Effective date: 2026

This is a license, not a sale. Aurora Apps grants you a personal, non-exclusive, non-transferable license to use Sovereign Vault on devices you own or control, subject to Apple's Licensed Application End User License Agreement and the terms below.

No warranty. Sovereign Vault is provided "as is," without warranty of any kind, express or implied, including fitness for a particular purpose.
Irrecoverable data loss is by design, not a defect. If you lose both your PIN and master password, or trigger the escalating lockout through repeated failed unlock attempts, the contents of your vault become permanently and irreversibly unreadable. This is a deliberate security property described in the app's own documentation, not a malfunction — Aurora Apps has no technical ability to recover this data under any circumstance and bears no liability for data loss arising from it.
Limitation of liability. To the maximum extent permitted by law, Aurora Apps is not liable for any indirect, incidental, or consequential damages arising from use of the app, including loss of data, loss of business, or loss of profits.
No reverse engineering. You may not decompile, reverse engineer, or redistribute the app except as permitted by applicable law.
Termination. This license terminates automatically if you fail to comply with its terms; you may also stop using the app and delete it at any time.
Governing law. This agreement is governed by the laws applicable in the jurisdiction of the developer's residence, without regard to conflict-of-law principles.

Questions about this agreement: mnemomemory@proton.me