Privacy by design requires transparency by design. Here's exactly how EchoVaults protects your data and why we'll never compromise on your privacy.
We believe trust shouldn't require blind faith. Every technical decision, security measure, and privacy practice is documented here for your review and independent verification.
Architecture
Every design decision prioritizes local control over convenience. Your data stays where it belongs — with you.
Technical Implementation
Detailed technical information about our encryption and security measures.
Algorithm: AES-256-GCM (Galois/Counter Mode)
Key Derivation: PBKDF2-SHA256 with 100,000+ iterations
Salt Generation: Cryptographically secure random 32-byte salts
IV/Nonce: Unique 12-byte nonces for each encryption operation
Authentication: Built-in authenticated encryption prevents tampering
Key Storage: Derived keys never stored persistently
iOS: iOS Keychain for secure password storage
Android: Android Keystore with hardware security module support
Biometrics: Optional biometric unlock using platform APIs
Sandbox: App sandbox prevents other apps from accessing data
Permissions: Minimal permissions requested
Updates: App updates cannot access existing encrypted data
Password Policy: Enforced minimum complexity requirements
Brute Force Protection: Exponential backoff for failed attempts
Memory Protection: Sensitive data cleared from memory after use
Screen Recording: Blocked during sensitive operations
Debug Prevention: Anti-debugging measures in production
Code Obfuscation: Critical code paths obfuscated
Open Source: Encryption modules publicly available on GitHub
Reproducible Builds: Build process documented and reproducible
Third-Party Audits: Regular security audits by independent firms
Bug Bounty: Rewards for security researchers
Transparency Reports: Regular updates on security practices
Code Signing: All releases cryptographically signed
Visual representation of EchoVaults' complete offline architecture.
You write messages, upload photos, or documents in the app
Content is immediately encrypted with AES-256 using your master password
Encrypted data is stored only in your device's secure storage, nowhere else.
Data never leaves your device automatically
We have no servers to receive or store your data
No user accounts or profiles to link data to you
You can manually export encrypted backups and transfer them to other devices. The backup process uses the same AES-256 encryption, and only someone with your master password can decrypt and import the data on another device.
Trust shouldn't require blind faith. Our entire encryption implementation is open source and available for security researchers to audit.
Found a security issue? Email trust@echovaults.org for our responsible disclosure process.
Most apps claim privacy while collecting extensive data. Here's exactly what we don't collect.
Verification: You can monitor all network traffic from EchoVaults using tools like Charles Proxy or Wireshark. You'll find zero network requests.
We know privacy is not a one-time decision. It requires ongoing commitment and regular updates.
Every three months, we publish detailed reports about our practices, any security incidents (there haven't been any), and updates to our policies.
Independent security firms audit our encryption implementation annually. Full reports are published publicly after any findings are addressed.
We reward security researchers who find vulnerabilities. Our responsible disclosure process ensures issues are fixed before public disclosure.
We pledge to maintain this level of transparency as EchoVaults grows. If we ever consider changes that might affect user privacy, we'll announce them publicly and explain our reasoning in detail.