Skip to content

Even we can't read it

Your family's documents and passwords are locked on your own phones and laptops before they reach us. Here is what that means, in plain words, and what it doesn't.
Report a security problem

How it keeps it yours

The key that locks your things is made on your device and never leaves it. There is no button we can press, and no support ticket we can escalate, that opens them.

Locked on your phone

Before anything is saved, your phone or computer locks it with a key that only your family's devices have.

We keep only the locked copy

Our servers hold the locked version and nothing else. Anyone who broke in, or any of our staff, would find files nobody can open.

Your family opens it

Your fingerprint or face opens it on the devices you have added. If you lose every device, the Recovery Kit you wrote on paper gets you back in.

See it happen

Make something up, and please don't type a real PIN or password here. Nothing leaves this tab, and you shouldn't have to take our word for that.

A demonstration with a throwaway key that exists only in this tab. Your real vault works the same way, except the keys never leave your family's devices, so we couldn't show you the left panel if we wanted to.

What your browser holds

—

What our server would store

—

Nothing you type here leaves your device. (If you're technical: open your browser's network tab and type again. This page sends nothing.)

What we can and can't see

We would rather be exact than sound impressive. On the left are the account details we need to run the service. On the right is what is locked before it leaves your device.

We can see

  • Your email and the names of the people in your family

  • Which plan you are on

  • When you last signed in

  • Document titles, categories and dates

    They power search and reminders. The files themselves stay locked.

  • Calendar event titles and times

    So reminders and invitations can go out. Places, notes and other details stay locked.

  • The wording of reminders

    Reminders go out by email and message, so keep them general.

  • A mobile number, only if you add one

    For WhatsApp notices, confirmed by a code. It can never sign you in.

  • Anything you choose to email

    An emailed copy passes through our mail server on its way to your family. We send it on and don't keep it.

  • Bug reports you send us

    We have to read a report to fix what it describes.

We can never see

  • What is inside your documents and files

  • Notes, health records and passwords

  • Photos and anything you upload

  • Your master password or Recovery Kit

Not a promise to look away. The key that would open it never exists on our side. The full list is in our Privacy Policy.

Signing in, and getting back in

Your fingerprint, not an emailed code

You sign in with a passkey: your fingerprint, face or phone PIN. There is no email sign-in, no text-message code and no magic link. Your billing email gets receipts and security alerts, and can never be used to get in.

Passkeys, explained

A Recovery Kit on paper

At signup you write a recovery code on paper. If every phone and laptop is lost, that code gets you back in after a 48-hour safety wait, or sooner if someone in your family approves it. We can't reset it for you, and that is the point.

How recovery works

If something goes wrong

What happens if you are ever breached?

Locked content stays locked, because the keys are made on your devices and never leave them. What someone could take is the account details listed above. We will tell affected families within 72 hours of becoming aware of it, and notify CERT-In within 6 hours of becoming aware of it, where Indian law requires it.

Can you get me back in if I lose everything?

No, and that is the honest cost of us holding no key. Your paper Recovery Kit is the way back in, which is why signup asks you to write it down before anything else.

What can WhatsApp see if I turn those notices on?

Your number, the pre-approved message we send, and when it was delivered and read. Nothing from your vault: the messages say something happened and to open the app, never what a record says. Removing the number stops them at once.

What happens to our things if we stop paying?

Nothing is deleted for 90 days after a failed payment. Reading and downloading keep working the whole time, and we warn you before anything is removed.

Found a security problem?

We want to hear about it before anyone else does. Email support@aevoriscloud.com with enough detail to reproduce it and we will acknowledge it within 24 hours. We won't take legal action against good-faith research that respects other families' data.

Scope and what we commit to