Security

Security is the core of what we do. vaultsuite.dev is built on CryptPad's end-to-end encryption, and we layer additional protections on top to ensure your data remains private, intact, and available.

End-to-end encryption

All documents are encrypted in your browser before being sent to our servers. The encryption keys are derived from the document URL fragment (the part after #), which is never sent to the server.

This means:

  • We cannot read your documents — even if we wanted to
  • We cannot hand over your data to law enforcement — we don't have the keys
  • A breach of our servers would expose only encrypted ciphertext

CryptPad uses the TweetNaCl library (a portable version of NaCl) for encryption, which is widely audited and considered state-of-the-art.

EU data residency

All data is stored in the European Union:

  • Compute: Fly.io's AMS (Amsterdam) region
  • Databases: Neon (EU region)

Your documents and your instance stay in the EU, and we are finalizing our formal GDPR compliance program: and the only data processed by non-EU subprocessors is operational metadata (your email, payments) under EU Standard Contractual Clauses. See our subprocessor list for details on every third party that touches your data.

Dedicated instances

Each customer gets their own CryptPad instance running in an isolated container on Fly.io. There is no shared tenancy — your instance is completely separate from other customers.

This means:

  • No "noisy neighbors" affecting your performance
  • Isolation at the infrastructure level (separate containers, volumes, networks)
  • Your own dedicated resources (CPU, RAM, storage)

Backups and disaster recovery

Every instance volume gets a daily automated snapshot on Fly.io's EU infrastructure, encrypted at rest. Snapshots are point-in-time copies, so we can roll your instance back to any day in the window.

  • All tiers: 14-day snapshot retention
  • Restores: contact support and we restore from any retained snapshot

Restore drills are part of our operations calendar, so the restore process is exercised — not just documented. See our deployment page for details on our infrastructure.

Access controls

Your instance is accessible only via its own *.vaultsuite.dev subdomain. We use TLS for all connections and HSTS to prevent downgrade attacks.

The dashboard (where you manage your instance) uses:

  • Password authentication with bcrypt hashing
  • Session tokens stored in secure, HTTP-only cookies
  • CSRF protection on all state-changing endpoints

We plan to add TOTP-based two-factor authentication in a future release.

Incident response

In the event of a security incident, we follow a structured response plan:

  1. Detection: automated alerts + manual monitoring
  2. Containment: isolate affected systems within minutes
  3. Investigation: determine root cause and scope
  4. Remediation: fix the vulnerability and restore from backup if needed
  5. Communication: notify affected customers within 72 hours (GDPR requirement)

Because of end-to-end encryption, a server breach would expose only encrypted data — a significant reduction in impact compared to traditional SaaS.

Vulnerability disclosure

If you discover a security vulnerability in vaultsuite.dev or CryptPad, we ask that you report it responsibly:

  • Email: security@vaultsuite.dev
  • Do not disclose the vulnerability publicly until we've had a chance to address it
  • We'll acknowledge your report within 48 hours and provide a timeline for resolution

For vulnerabilities in CryptPad itself, please also report to the CryptPad team via their contact page.

Compliance

We are committed to GDPR compliance. Our Privacy Policy explains what data we collect, why we collect it, and your rights under GDPR (access, rectification, erasure, portability).

For B2B customers, we provide a Data Processing Agreement (DPA) that contractually binds us to GDPR requirements.