How Veloxise Vault keeps a password secret.
The short version: your browser encrypts, your server stores, and only people holding the right key can decrypt. Here is the longer version — including what an administrator can and cannot do.
From your keyboard to the database
Four steps happen every time you save an item.
You unlock your vault
Your vault passphrase unlocks your private key in the browser. The passphrase is never sent to the server.
The browser encrypts
The item is encrypted with OpenPGP using the vault's key before it leaves your device.
The server stores ciphertext
The database holds only encrypted text and, for each member, a copy of the vault key encrypted for that member.
Members decrypt locally
A teammate's browser decrypts their copy of the vault key and then the item — again without the server seeing either.
One key per vault, one copy per person
When a vault is shared, its key is wrapped separately for every member. Removing a member creates a new vault key, so an old copy is worthless.
A log that shows tampering
Sign-ins, shares, resets and policy changes are written to a chained audit log. Each entry carries the fingerprint of the previous one; editing or deleting an entry breaks the chain.
Who can open what
Administrators run the server and help people get back in. They cannot read vaults.
| Action | You | Your team (when shared) | Your server admin | Veloxise | Someone who steals the database |
|---|---|---|---|---|---|
| Read a password in your vault | Yes | Only shared vaults | No | No | No |
| Reset your sign-in password or two-factor | Yes | No | Yes, audited | No | No |
| Reset your encryption key (gives an empty vault) | Yes | No | Yes, audited | No | No |
| Recover a lost vault passphrase | With your recovery kit | No | No | No | No |
Protections around the vault
Two-factor and passkeys
Required for owners and administrators; available for everyone.
Rate limits
Repeated failed sign-ins and form submissions are slowed down.
Strict browser rules
A content security policy and security headers limit what a page may load or run.
Confirm before changing
Sensitive admin actions ask for the password again.
Your infrastructure
Runs in your network, behind your firewall, with your backups.
No phoning home
Your server does not send usage data to us.
Our honest status
Veloxise Vault has not yet been reviewed by an independent security firm. Test it in your own environment first, keep backups and keep recovery kits offline. Found a problem? Tell us privately and we will respond quickly.