Security model

Zero-knowledge by design.

The short version

Your safe password never leaves your device. We store only encrypted blobs. We literally can't read your passwords.

If our servers are stolen tomorrow, the attacker gets ciphertext — billions of years of brute force away from anything readable.

You hold the key

Encryption happens in your browser or on your phone, not our servers. The safe password is the only thing that can unlock your safe, and it never leaves the device you typed it on.

We see scrambled text

DynamoDB stores AES-256-GCM ciphertext. Without your key, every byte is random — a server breach reveals nothing useful.

We can't help with recovery

Forgotten safe passwords are unrecoverable. That's a feature, not a bug — it's the property that makes the rest of the system trustworthy. Your designated recovery contacts can help you reset your password.

How the crypto actually works

When you create your safe, your safe password is fed through PBKDF2-HMAC-SHA256 with 600,000 iterations. The salt mixes your email address and a per-safe random value so two users with the same password produce different derived keys.

The derived key encrypts your safe contents with AES-256-GCM — authenticated encryption, so tampering with ciphertext is detected, not silently decrypted into garbage.

For server authentication we use OPAQUE-3DH, a password-authenticated key exchange. The server never sees your safe password — not at registration, not at login. Even a malicious server can't learn it.

Org-event metadata wraps an asymmetric X25519 key per organisation, so admin views of member activity are end-to-end encrypted to the admin — not readable by us.

Audit details: We publish our algorithm choices, parameters, and key-derivation flow so independent reviewers can audit them.

Threat model

Threat Status Detail
Compromised server database Safe Only ciphertext stored. Master key never reaches the server.
Hacker on network between you and server (TLS MITM with stolen session JWT) Safe Your safe remains encrypted; the server cannot decrypt it either.

Reporting a security issue

Email support@milcreto.com with the subject [security]. We respond within three business days. Please don't open public issues for vulnerabilities.