Security at Dprime Vault
A clear boundary: encryption and decryption happen on your device.
Effective 2 September 2026
Encryption model
The web client encrypts the vault with AES-256-GCM under a random data key. Your master password derives a separate key that wraps the data key. Every encryption operation uses a fresh nonce and authenticated context.
Authentication
The browser sends a derived authentication secret rather than the master password. The service hashes that value again with Argon2id. Authenticator MFA is required before vault changes are accepted.
Recovery
Your recovery kit contains independent authentication and vault-recovery material. Only the authentication portion is presented to the service; vault recovery occurs locally and rotates the previous recovery material.
Billing separation
The billing system sends plan and subscription state. It does not receive vault keys or plaintext vault contents.
Scope and limitations
Encryption cannot protect plaintext after an authorized device is compromised. Dprime Vault has not yet completed an independent security audit and does not claim certification.
Report a vulnerability
Do not include real customer secrets in a report. Send security concerns privately to security@dprimevault.com.