Security
Version 1.0 · Last updated 26 Sep 2026 · Version history ·
THE SHORT VERSION
- Encrypted everywhereIn transit and at rest.
- Passwords by defaultEmail codes only for sign-up, new devices and resets.
- You see every deviceSign out anywhere from Me › Security.
- Report a vulnerabilityWe welcome responsible disclosure.
A plain-language summary. If it differs from the full text below, the full text applies.
Encryption
All traffic uses HTTPS with HSTS. Data and documents are encrypted at rest by our database and storage provider.
Vault design
Each person’s documents are stored privately and access rules stop anyone else’s account from reading them. Files are shown through short-lived links. Deleting a document gives you a few seconds to undo, then it’s permanently removed.
Account security
Passwords are stored only as a secure hash. Sign-in codes are sent by email only, never by SMS or WhatsApp. You can see and sign out your devices, and we alert you to new sign-ins.
Responsible disclosure
Found a security issue? Use Help & support in the app (Me › Help & support) with details and steps to reproduce. Please don’t access other people’s data or disrupt the service. We’ll acknowledge within 3 working days and won’t take legal action over good-faith research.
Incidents
If a breach puts your data at risk, we’ll notify the Nigeria Data Protection Commission within 72 hours and tell affected users without undue delay, including what happened and what to do.
Version history
- v1.026 Sep 2026First published version