Security Model

Transparency is security. Here is exactly how Klypt works.

1. Overview

Klypt is built on a foundation of absolute privacy. Our security model is simple: we cannot lose, sell, or leak your data because we never have it.

Klypt operates entirely offline. It does not trust the network, and it does not trust the developer. By removing the cloud from the equation, we eliminate entire classes of remote attacks, data breaches, and server-side vulnerabilities. Zero-knowledge is not just a feature; it is the architectural standard of the entire application.

2. Zero-Knowledge Architecture

Zero-knowledge means that Klypt knows nothing about your data. The architecture is designed so that the developer has no technical ability to access your vault, even under legal compulsion.

No Central Servers

There is no database to hack. Your data lives only on your device.

No User Accounts

We do not collect emails, phone numbers, or metadata.

Client-Side Only

All logic runs locally. No data is ever sent to a backend API.

Master Password Privacy

Your master password is never stored or transmitted.

3. Local-Only Encryption

Your vault is encrypted at rest using AES-256 (Advanced Encryption Standard with a 256-bit key).

  • Key Derivation: Your encryption key is derived directly from your Master Password using a secure key derivation function (KDF).
  • On-Device Processing: Encryption and decryption happen solely within your device's memory.
  • Ephemeral States: Decrypted data exists in memory only while the app is unlocked. Locking the app clears sensitive data from memory.

4. Authentication Model

The Master Password acts as the root of trust. Without it, the data is mathematically indistinguishable from random noise.

Biometric Unlock

For convenience, Klypt supports biometric unlock (fingerprint/face).

  • Biometrics are handled entirely by the Operating System (Android/iOS).
  • The app never accesses raw biometric data.
  • The app only receives a cryptographic token or success/failure signal from the OS secure enclave.

5. Backup & Recovery Model

Because there is no central server, there is no "Forgot Password" button.

  • Encrypted Backups: You can export your vault to a file. This file is encrypted with your Master Password.
  • User Control: You decide where to store this backup (e.g., Google Drive, local USB, email).
  • The Trade-off: If you lose your device AND have no backup, your data is gone. If you forget your Master Password, your data is permanently inaccessible. This is a deliberate security trade-off to ensure no one but you can access your vault.

6. Threat Model

Klypt is designed to protect against remote attackers, server breaches, and mass surveillance. However, no security system covers every possible scenario. Klypt does NOT protect against:

  • ✕Compromised Devices: Malware or keyloggers on your device could intercept your Master Password as you type it.
  • ✕Physical Coercion: If you are forced to unlock your device, the encryption cannot protect the data.
  • ✕User Negligence: Using a weak Master Password (e.g., "123456") or storing backups in public folders.
  • ✕Permanent Data Loss: If you lose your device without a made backup, recovery is impossible.

7. Design Philosophy

We prioritize Security over Convenience. We believe in transparency over marketing, and user ownership over vendor lock-in.

Klypt will never track you, never sell your data, and never compromise on encryption standards for the sake of "easier" access. Your data is yours alone.