How York Vault protects your files

This page describes the current design of York Vault. It covers iPhone, iPad, Android, Mac and the web app. The vault format, the key design and the encryption are the same on every platform. Where Android uses a different part, this page names it.

What we can and cannot see

We cannot open your items. We cannot read their names, dates, places or album names. We cannot reset your code. York Vault has no account. Our servers hold your library only if you use York Cloud (Pro). Even then, they hold only encrypted data and no key. Support never asks for your code or your recovery key.

Encryption of each item

• Each photo, video and file gets its own random 256-bit key.
• Content is sealed with AES-256-GCM in 1 MiB chunks. On iPhone, iPad and Mac, York Vault uses Apple’s CryptoKit. Each chunk has its own nonce and carries the chunk number and file id as authenticated data, so chunks cannot be swapped, reordered or cut without detection.
• File names, dates, places, thumbnails and the library index are encrypted too.

Your code and the phone’s secure hardware

• Each library has a random master key. It is stored only in wrapped form, in key slots.
• The code slot combines Argon2id (64 MB of memory, 3 passes) with a key held in the phone’s secure hardware. On iPhone and iPad, that is a key agreement inside the Secure Enclave. On Android, it is a key in the Android Keystore. The key sits in StrongBox where the phone has it, and otherwise in the phone’s Trusted Execution Environment. Android’s documentation says the key material of such a key “is never exposed outside of secure hardware”. A copy of the app’s files on another device cannot test a single guess.
• Fast unlock opens a separate slot held by the same secure hardware. On iPhone and iPad, that is Face ID or Touch ID. On Android, York Vault accepts only fingerprint or face unlock that Android rates as strong (Class 3). If someone adds a new face or fingerprint in the phone’s settings, that slot stops working and York Vault asks for the code.
• Wrong-code limits apply to every guess, because every unlock passes through the Secure Enclave or the Android Keystore.

Recovery key

At setup, York Vault creates a 128-bit recovery key and shows it as 12 words. You type 3 of them back before you continue. The key opens your library, sets a new code and restores a backup on a new phone. It is never stored in readable form and never sent to us. York Vault cannot show it again later, because anyone inside the app could then copy it. You can make a new key after you enter your code, which voids the old one.

Optional 72-hour recovery

This is off until you turn it on. When it is on, York Vault keeps a recovery secret in your Apple Account or Google account, end-to-end encrypted:

• On iPhone and iPad, in iCloud Keychain under your Apple Account.
• On Android, in Block Store under your Google account. Google end-to-end encrypts this data when the phone has Android 9 or later and a screen lock (PIN, pattern or password).

To use it, you tap Forgot code, confirm the phone’s own screen lock, and wait 72 hours. During the wait, your library stays locked and a banner shows on every device with York Vault. The right code or recovery key cancels the reset.

Backup to your own iCloud or Google Drive

On iPhone and iPad, backup goes to your own iCloud (the private CloudKit database). It costs you nothing beyond your iCloud storage. Items leave the iPhone already encrypted. Record names are random, chunks are padded to 1 MB steps, and the manifest is encrypted, so iCloud sees no file names, types, dates or album structure. An item counts as backed up only after the server confirms its chunk hashes. How backup works.

On Android, backup goes to your own Google Drive, in the app data folder. Google says this folder is “only accessible by your app”. You and other Drive apps cannot see it. Items leave the phone already encrypted, so Google stores only encrypted data and no key. The backup uses your Google storage. Status and the restore check work the same way as on iPhone.

An iCloud backup does not restore to Android, and a Drive backup does not restore to iPhone. To move between iPhone and Android, use phone-to-phone transfer over local Wi-Fi. It works in both directions. The encrypted backup file also opens on either. Sync between iPhone and Android runs through York Cloud (Pro), encrypted on each device. Sync between devices on the same platform (Plus) runs through your own iCloud or Google Drive.

The web app

The web app at app.yorkvault.com is part of Pro. It has no account and no password. The page shows a QR code. York Vault on your phone scans it and sends the keys for this session over an end-to-end encrypted channel. The browser then reads your York Cloud items and decrypts them in the page.

• The web shows only the library that was open on the phone that paired it. Codes, cover libraries and erase codes are never on the web.
• Nothing stays in the browser when you close the tab, or after 15 minutes with no activity.
• Your phone lists the active web sessions and can end each one.

Deleting

Deleting an item destroys its key first, then the encrypted data is removed. We do not claim multi-pass overwrite, because it does not work on flash storage.

Sharing and export

When you share or export, York Vault removes location, camera serial, device model, dates and other photo details by default. A switch keeps them for one share, with a preview of what goes. Exported copies leave York Vault’s protection, and the app says so before the first export.

Screenshots and screen recording

• iPhone and iPad. iOS lets no app block a screenshot. While the screen is recorded, mirrored or sent over AirPlay, York Vault replaces your items with the cover. After a screenshot, York Vault can lock at once if you turn that on.
• Android. York Vault sets FLAG_SECURE on every screen. Android then blocks screenshots and screen recording of York Vault. It also does not show York Vault on a display that is not secure, such as a cast screen.

Codes, keyboards and the network

Code fields use secure entry and turn off autocorrect, predictions and dictation. On iPhone and iPad, they allow only the system keyboard, and App Transport Security stays on with no exceptions.

Ads, measurement and your library

York Vault has no ads. It does measure its own ad campaigns with an attribution SDK. On Android, it also uses the Google Play Install Referrer and the Android advertising ID. That code lives in a module that cannot reach your library, sends only an allowed list of events, records no screens and no sessions, and never runs in the share extension, camera extension or widgets. An automated test adds a file with a known name and fails the build if that name, a code or the recovery key appears in any network traffic.

Purchases never lock your files

On iPhone, iPad and Mac, purchases are verified on the device with StoreKit 2. On Android, purchases go through Google Play’s billing system. Viewing, export, trash recovery, backup and restore never check whether you pay. A test runs the app with an expired subscription and fails the build if any of those paths shows a paywall.

What this design does not protect against

• Someone who knows your York Vault code, or who watches you type it.
• A phone that is already compromised by malware with full system access.
• Copies you export or share outside York Vault.
• Loss of both your code and your recovery key, when the optional 72-hour recovery is off. In that case nobody, including us, can open the items.
• Android’s documentation says that on Android 11 and earlier, FLAG_SECURE is reliable on about 70% of devices. Some devices can record keyboard taps.

Published design and audit

We publish a white paper that matches the code, an outside audit of the encryption core, and the source code of that core library. Report a problem to security@yorkvault.com (see security.txt).