Security
SafeTale's security, in one minute
Your vault's key is made on your own computer — at the moment you create your account. Not at our end.
Your data leaves already unreadable — What we receive looks like a string of characters with no meaning.
Your password is not known to us — We keep only a fingerprint of it, from which the password cannot be recovered.
Our administrators never see a vault's contents — The administration tool does not know how to display it: there is no button for that.
The most important setting is protected by your mailbox — Changing your trusted contact requires an e-mail confirmation.
In detail
This section is meant to be checked, not merely read. Every figure corresponds to a line of code.
What is under way
The format that currently protects your key's envelope dates from the project's early days and is no longer state of the art.
A hardened format — PBKDF2-HMAC-SHA256 derivation at 600,000 iterations and AES-256-GCM authenticated encryption — is already written, tested on both sides, and deployed FOR READING in the Windows client. It will only be switched on for writing once the installed base can read it: the reverse order would make vaults unreadable from earlier versions.
This is the kind of work one does not usually talk about. We would rather talk about it.
Found a vulnerability?
Write to us. Describe what you found and how to reproduce it; we acknowledge receipt and keep you informed of the fix.
We will take no action against research carried out in good faith, without exfiltrating user data and without degrading the service.