One set of protections, built in from day one.

Encrypted in transit

All traffic is served over TLS 1.2 or 1.3 with HTTP Strict Transport Security (one-year max-age, includeSubDomains, preload), automatic HTTPS redirection, secure-only session and CSRF cookies, and content-type-sniffing protection. The program on each computer only talks to the dashboard over HTTPS: it requires TLS 1.2 or newer, always checks the server’s certificate, and never follows a redirect. The server refuses any program call that is not encrypted.

Stored encrypted

The database and its backups are kept in encrypted storage (AES-256). The most sensitive values we hold, such as payout bank details and stored credentials, are encrypted a second time by the application, so a copy of the database alone isn't enough to read them.

MyVaultMate: metadata only, by design

For every finding we store the PII type, severity, file location, the compliance frameworks it implicates, and at most a short redacted sample such as ***-**-1234 (capped at 64 characters). For each file it also keeps the size, date modified, how much of it was read, where in the file a finding is, and a SHA-256 fingerprint (which cannot be turned back into the contents). No field that holds scan results can hold a full sensitive value from your files, and the documents being scanned never leave your machine — the program you run reads them locally and reports only that metadata. After each scan the computer also uploads its own report of that scan, and the dashboard builds a PDF report and a raw-data CSV from the same metadata, so your team has a history for each computer without pulling files off each machine by hand. Report files are stored outside the public website, only a signed-in member of your organization can download them, and every download is logged. We keep the newest 25 scans of each computer, with their report files, and delete older ones automatically; only each scan's counts (no file names or findings) stay for 13 months, for the trend in the Summary report. A file path or file name can itself contain a person's name. If yours do, switch on Keep file names off the dashboard (Scan settings): each computer replaces every file and folder name with a tag before sending, using a key that never leaves the computer, so the dashboard never receives the names (common folders such as Desktop, and the file type, stay readable). The computer's own report files then stay on the computer, and the dashboard builds its PDF and CSV from the tagged scan.

Computer authentication

A computer joins your account when the account owner signs in from it with the website's email, password and authenticator code (two-factor is required for every account), or with a one-time, 6-character pairing code (valid for 15 minutes, usable once) for an IT provider. Either way the computer gets its own device token; wrong guesses are rate-limited, and repeated failures pause sign-in from the programs for that account for ten minutes. That token belongs to that one computer, is sent as a bearer credential over TLS, is stored on our side only as a SHA-256 hash, is rate-limited, and is never tied to a user's password. On the computer it is kept encrypted with Windows DPAPI, or in a file only that user can read on Linux. Unpair a computer from its page under Computers and its connection is cancelled at once, even if the computer is switched off; signing in again retires the old token. The programs only ever talk to your dashboard over TLS, verify its certificate, and refuse a plain http:// address.

Quarantine and Vault on the computer

Files you put in the program’s Quarantine or Vault are encrypted on that computer (AES-256-GCM, each file with its own key), and their names are hidden too. The key that opens them is itself locked with a key your dashboard keeps, which it hands to the program only after checking your 6-digit vault PIN (5 wrong tries start a wait, 10 switch the PIN off until an account sign-in) or your account sign-in with its authenticator code. So the files cannot be opened from what is on the computer alone, and the PIN cannot be guessed offline. Unlocking needs the internet; only that key travels, over TLS, and the files never leave the computer. It locks again after 5 minutes without use. An administrator can ask a computer to quarantine files from the dashboard, but the computer only takes files its own recent scans reported, never deletes anything, and never puts a file back on the dashboard’s say-so.

Limits: while it is unlocked, the open program holds the key. Nothing stops a program already running on the computer, ransomware included, from deleting or scrambling the encrypted files (it cannot read them), and there is no copy anywhere else, so keep your normal backups; the program warns you when a vault file is missing or has changed. Deleting a file for good overwrites it before removing it, but SSDs, OneDrive or Dropbox version history, backups and Windows shadow copies can still hold older copies.

Account access

Passwords are hashed, never stored or visible in plaintext. Two-factor authentication (an authenticator app) is required for every sign-in, for customers and for our own staff alike. The same email, password and authenticator code also sign in the Windows and Linux programs. Your organization's data is scoped to your organization — it never crosses into another customer's account.

Staff access is logged

Internal staff access is role-gated — a given staffer can only reach the sections their role covers — and sensitive actions, including any time staff view an account as you (impersonation) to help with support, are logged with who, when, and which account.

Payments via Stripe

All billing runs through Stripe. We never receive or store card numbers: Stripe gives us back only a payment reference, the card brand and last four digits, the amount and the status.

Updates

The program never updates itself: someone at the computer presses Update now, and the new file is checked against its published SHA-256 before it is used.