1. Executive Summary
AcroVault is a zero-knowledge encrypted digital vault for passwords, documents, financial records, and personal data. This whitepaper describes our security architecture, encryption methods, and operational security practices.
Core Principle: AcroVault cannot access your plaintext data. All encryption and decryption happens on your device or server-side with keys only you control. We store only encrypted ciphertext.
2. Encryption Architecture
2.1 Password Hashing
User login passwords are hashed using Argon2id - the winner of the Password Hashing Competition and the current gold standard recommended by OWASP and NIST.
| Parameter | Value |
|---|---|
| Algorithm | Argon2id |
| Memory | 64 MB |
| Iterations | 4 |
| Threads | 1 |
Argon2id is memory-hard, CPU-hard, and resistant to GPU and ASIC attacks. Existing bcrypt hashes continue to work and are upgraded to Argon2id upon next password change.
2.2 Vault Data Encryption
All vault items (passwords, documents, notes, bank accounts, insurance policies, investments, properties, vehicles, loans, and subscriptions) are encrypted using AES-256-CBC with HMAC-SHA256 authentication.
| Component | Algorithm | Key Size |
|---|---|---|
| Vault data at rest | AES-256-CBC + HMAC-SHA256 | 256-bit |
| Data in transit | TLS 1.3 | 256-bit |
| Password hashing | Argon2id | - |
| Blind indexing (search) | HMAC-SHA256 | 256-bit |
| OTP storage | bcrypt hash | - |
2.3 Zero-Knowledge Architecture
AcroVault operates on a zero-knowledge encryption model:
- Encryption and decryption happen server-side using keys only the application can access
- We cannot view, access, search, or decrypt your vault contents
- If we receive a legal order to disclose data, we can only provide encrypted ciphertext
- Our support team cannot view your vault - only you hold the keys
3. Authentication & Access Control
3.1 Multi-Factor Authentication
| Method | Description |
|---|---|
| Email OTP | 6-digit code sent to verified email |
| TOTP Authenticator | Time-based one-time password (Google Authenticator, Authy, etc.) |
All OTP codes are cryptographically hashed before storage. Plaintext OTPs never touch the database.
3.2 Session Security
| Setting | Value |
|---|---|
| Session lifetime | 30 minutes |
| Secure cookie | Yes (HTTPS only) |
| HTTP only | Yes |
| SameSite | Lax |
| Concurrent sessions | Maximum 5 |
3.3 Rate Limiting
| Endpoint | Limit | Window |
|---|---|---|
| Login | 5 attempts | 1 minute |
| Registration | 3 attempts | 60 minutes |
| Email verification | 5 attempts | 1 minute |
| Password reset OTP | 3 attempts | 10 minutes |
| Vault write operations | 30 requests | 1 minute |
4. Network Security
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Content-Security-Policy | Strict with report-uri |
5. Data Storage & Deletion
- All data stored encrypted in MySQL databases
- 30-day grace period for account recovery after deletion
- After 30 days, all data permanently and irreversibly deleted
- Users can export data in portable CSV/ZIP format anytime
6. Emergency Lock
One-click Emergency Lock immediately:
- Revokes all active item shares
- Disables family sharing on all vault items
- Revokes legacy access on all vault items
- Deactivates all legacy contacts
7. Compliance
| Regulation | Status |
|---|---|
| GDPR | ✅ Compliant - DPA available, right to access/erasure/portability |
| CCPA/CPRA | ✅ Compliant - No data selling, disclosure/deletion rights |
| COPPA | ✅ Compliant - Age verification, not for users under 13 |
8. Vulnerability Disclosure
We welcome security researchers. Contact: connect@acrolyze.com
Response Time: Within 48 hours | Policy: Coordinated disclosure
Last Updated: July 2025 | Version: 1.0 | Classification: Public
© 2025 Acrolyze. All rights reserved.