Security is at the core of everything we build. This policy outlines our comprehensive approach to protecting your data and ensuring the confidentiality of your secrets.
Zero-Knowledge
We never have access to your plaintext secrets. All encryption happens on your device before data reaches our servers.
Military-Grade Encryption
AES-256-GCM encryption with PBKDF2 key derivation ensures your data is protected with industry-leading security standards.
Auto-Deletion
Your secrets are automatically and permanently deleted once viewed or expired, ensuring no data retention.
Data Protection Measures
How we protect your information at every level:
Client-Side Encryption
All encryption happens in your browser before data transmission
HTTPS/TLS Only
All communications are encrypted with modern TLS protocols
No Data Collection
We don't track users or collect personal information
Secure Infrastructure
Enterprise-grade hosting with regular security updates
Rate Limiting
Protection against automated attacks and abuse
Access Controls
Strict access controls and monitoring systems
Encryption Standards
We use industry-leading cryptographic standards:
AES-256-GCM
Military-grade symmetric encryption for data protection
PBKDF2
Password-based key derivation with 100,000 iterations
HMAC-SHA256
Secure message authentication codes
Secure Random
Cryptographically secure random number generation
Perfect Forward Secrecy
Compromised keys don't affect past communications
Vulnerability Management
Our approach to identifying and addressing security issues:
Regular security audits and penetration testing
Automated vulnerability scanning and monitoring
Prompt security patching for all dependencies
Code reviews with security focus
Incident response procedures for security events
Ongoing security training for development team
User Security Responsibilities
How you can help maintain security:
Use strong, unique passwords for your secrets
Share secret links through secure channels only
Don't reuse passwords across different secrets
Be cautious of phishing attempts asking for secret links
Report security concerns immediately
Keep your browser and devices updated
Security Incidents: If you discover a security vulnerability or suspect unauthorized access to your data, please contact us immediately at [email protected] with "SECURITY" in the subject line. We will respond within 24 hours and take appropriate action.
Last updated: 10/14/2026
Next review: Within 90 days or as needed