Security at SafeKit

Local-first, zero-knowledge by design

SafeKit doesn't sync your vault to a server, because there isn't one holding it. Every item is encrypted and decrypted entirely on your device, using a key derived from your master password. That key never exists outside your device, in memory or otherwise, and it is never transmitted anywhere.

The only time vault data ever leaves your device is when you choose to share it, either directly, device-to-device, over an encrypted peer-to-peer connection, or by exporting an encrypted file yourself. Nothing leaves automatically, and nothing is held in escrow by us.

This means a request to "look up" or "recover" a password in your vault has only one honest answer: we can't. There is no server copy, no internal tool, and no support override, the decryption key was never ours to have, and the data was never ours to hold.

Encryption specifications

SafeKit uses well-reviewed, industry-standard cryptography rather than anything custom-built:

Local protections

Because there's no central account holding your vault, protection is built around your device and your choices:

• Biometric / PIN unlock - Face ID, Touch ID, or device fingerprint sensors unlock your local vault without retyping your master password every time; your master password itself never leaves the device.
• Device-to-device sync (optional) - if you use SafeKit on more than one of your own devices, syncing happens directly between them over an encrypted channel, not through a server that stores your vault.
• Encrypted export / recovery kit - you can export a fully encrypted backup at any time. We strongly recommend storing it (and your master password) somewhere durable and offline — if you lose both, we cannot recover your vault, by design.
• Sharing, on your terms - sending a password to someone else is always an explicit action: a direct P2P transfer they must accept, or a file you export and send however you choose. Nothing is shared silently or automatically.

Infrastructure - what we actually run

SafeKit has no server footprint, you store your own passwords.

Independent review

SafeKit is built and maintained by an independent developer. [Choose whichever is true:] [We haven't yet commissioned a paid third-party security audit — as the project grows, this is on the roadmap, and we'll publish results here when it happens.] / [SafeKit's client code is open source and available for review at {repo link}.] / [SafeKit underwent an independent audit in {month/year}; a summary is available at {link}.]

We run a responsible disclosure program (see below) and take reports seriously regardless of audit cadence.

Breach monitoring (optional)

If you enable it, SafeKit can check whether an email address or username saved in your vault appears in known breach databases. [Describe the actual mechanism honestly — e.g.: "This check is performed directly from your device against {third-party breach database, e.g. Have I Been Pwned}, using privacy-preserving partial-hash lookups. We do not see, log, or store the results — they're shown to you, locally, in the app."] This feature is off by default / opt-in, and can be disabled at any time.

Responsible disclosure

If you believe you've found a security issue in SafeKit, I want to hear about it. Email contactus@planndu.com" with details. As an independent developer I aim to acknowledge reports within 5 business days and will keep you updated as I investigate.