← Secludere

Security isn’t a feature.
It’s the architecture.

Secludere is built on a zero-knowledge model: your password, your keys, and your files never leave your devices in a form anyone else can read. Not to us, not to a cloud, not to anyone. Here is exactly how, in plain language first, then in detail.

Encryption

Encrypted before it touches the disk

Every document is encrypted on your Mac or iPhone before it is ever written to storage. The key that does it is derived from your master password through a deliberately slow, one-way function, which makes brute-force attacks impractical.

We never store your password and never store your key. The app holds the key in memory only while the vault is unlocked, and discards it the instant you lock it or quit.

Document cipherAES-256-GCM, authenticated, fresh 12-byte nonce per operation
DatabaseSQLCipher (AES-256), the whole vault encrypted at rest
Key derivationPBKDF2-SHA256, 600,000 iterations, per-vault salt
File keysHKDF-SHA256, a distinct key derived per attachment
Key storage32-byte DEK, random, wrapped under your password and your recovery phrase; never derived from either directly
BiometricsSecure Enclave-backed Keychain item, .biometryCurrentSet policy
Sync (optional)CloudKit private database; AES-256-GCM blobs; the DEK never leaves the device
Encrypted backupSingle-file export; AES-256-GCM keyed by PBKDF2-SHA256 (600k) from a passphrase you choose; restorable on any device
Zero-knowledge

We cannot read your vault, even if asked

Zero-knowledge means we are technically incapable of reading your files. Not contractually, not as a policy, architecturally. There is no copy of your password on a server, because there is no server holding your data. There is no admin override and no master key in escrow. If we wanted to open your vault, we could not.

Recovery

A 24-word phrase, held only by you

When you create a vault, Secludere generates a 24-word recovery phrase from the BIP39 word list, the same standard hardware wallets use. It is created on your device and shown to no one else. Write it down and keep it safe; it is your only path back in if you forget your password.

There is no “forgot password” link, and there cannot be one. If there were, anyone with access to your email could become you. Lose both the phrase and the password and your data is unrecoverable. Nobody can help. That is the guarantee, seen from its hardest angle.

Privacy

No telemetry, as a property of the build

No analytics. No crash reports phoning home. No usage tracking, no A/B tests, no third-party SDKs watching you scroll. Secludere does not know how often you open it, what you keep in it, or whether you use it at all. When you enable AI, only recognized text is sent to Anthropic, never images, under a zero-retention agreement, and never for training. We disclose Anthropic as the only sub-processor, and only when you opt in.

Scenarios

What happens if…

You forget your password

Unlock with your 24-word recovery phrase, then set a new one. Your documents are never re-encrypted in the process.

You lose your recovery phrase

While you still know your password, generate a fresh phrase from Settings. The old one stops working.

You lose both

The vault stays sealed forever. We cannot help, and neither can anyone else. That is what encrypted actually means.

Your Mac or iPhone is stolen

The vault is unreadable without your password, and Face ID / Touch ID gate every attempt. Wipe the device remotely with peace of mind.

Secludere or AGYCON shuts down

Your vault is local and the app keeps working. You hold the recovery phrase, so you are never locked out by a vanished company.

You want a backup off iCloud

Export the whole vault as one encrypted file sealed with a passphrase you choose. Store it on any drive or cloud, and restore it on a new device whenever you need.

A government compels your data

From us, there is nothing to hand over. We store no files, no keys, no passwords. By design.