Encrypted vault and secure folders
Storing, opening, exporting and deleting sensitive documents do not share the same security boundary. Use Secure Vault with a clear view of when an item stays encrypted and when it becomes an ordinary copy.
Open the interactive product view ↗It's more than just a lock icon.An encrypted workspace.
File contents, file names, and folder structure inside the vault are encrypted. The vault is kept separate from local AI and normal file memory.
Content and names are protected.
The simulation based on the vault, file list, and Trash in the Production interface. Only sample files are shown.
Deleting does not leave an open copy.
Secure Vault encrypts files and catalog information using libsodium-based XChaCha20-Poly1305. The password key is derived using Argon2id.
How to use it
- Open Secure, authenticate and select the files you want to protect.
- Lock the vault after work. Review the encrypted trash area for items removed inside the vault.
- Check the destination before exporting: a file extracted to an ordinary folder is outside the vault’s encrypted boundary.
Scope and considerations
The vault uses XChaCha20-Poly1305 secretstream; encrypted Finder folders use an AES-256 disk image. These are different storage paths. Window-sharing protections do not guarantee blocking every recording method. New screenshots may remain plaintext until routing finishes; other apps’ capture cannot be completely blocked.
Questions and answers
Are deleted items plaintext in trash?
Items removed inside the vault are kept in encrypted trash. Ordinary exported copies do not receive that protection.
What happens to the original file?
Review import and encryption choices. A normal source copy is not automatically considered securely erased; manage copies outside the vault separately.