Security Policy

DavianVault – Encrypted Password & Data Vault

Overview

Security is a core design principle of DavianVault – Encrypted Password & Data Vault.

DavianVault is built using a zero-knowledge architecture, ensuring that all sensitive user data remains encrypted and accessible only to the user.

This document describes DavianVault's security posture, supported platforms, and the responsible disclosure process for security issues.

---

Security Model

DavianVault follows a local-first, zero-knowledge security model:

• All sensitive data is encrypted locally on the user's device
• Encryption keys are derived from the user's master password
• The master password is never stored, transmitted, logged, or recoverable
• The application developer cannot access or decrypt user data
• Optional cloud synchronization transmits only encrypted data

At no point does DavianVault have access to plaintext user data.

---

Supported Platforms

DavianVault applies the same security guarantees across all supported platforms:

• Windows
• Apple platforms (macOS, iOS, iPadOS)
• Linux

Platform-specific integrations do not weaken or bypass encryption or key management.

---

Cryptography

DavianVault uses industry-standard cryptographic practices, including:

• Strong encryption for data at rest
• Secure key derivation from the master password
• Authenticated encryption to protect data integrity

Cryptographic parameters may be updated over time to address evolving security best practices.

---

Data Protection

DavianVault does not:

• Collect analytics or telemetry
• Use advertising or tracking SDKs
• Share user data with third parties

All stored data remains under exclusive user control.

---

Threat Model & Limitations

DavianVault is designed to protect against:

• Unauthorized access to stored data
• Server-side data exposure (for encrypted synchronization)
• Third-party service compromise

DavianVault cannot protect against:

• Compromised or infected user devices
• Weak or reused master passwords
• Loss of the master password

Loss of the master password results in permanent loss of access to encrypted data.

---

Vulnerability Reporting

If you believe you have discovered a security vulnerability in DavianVault, please report it responsibly.

How to Report

• Use the Support / Contact option available within the DavianVault application
• Select the option to contact support via email
• Provide a clear description of the issue
• Include steps to reproduce, if possible
• Specify the affected platform and application version

Please do not publicly disclose security issues before contacting us.

---

Disclosure Policy

• Reported vulnerabilities are reviewed promptly
• Valid issues are addressed in a timely manner
• Security fixes may be released without detailed public disclosure to protect users

---

Changes to This Policy

This Security Policy may be updated as DavianVault evolves. Updates will not reduce existing security protections.

---

Final Note

DavianVault is designed to minimize trust, reduce attack surface, and ensure that users remain the sole custodians of their sensitive data.

Security is treated as an ongoing process, not a one-time feature.