A password manager earns its place through its design, tests, and review. Here’s the protection we’re working toward, and the checks still ahead.
The development build now includes a local encrypted vault, passphrase unlock and locking, encrypted backups, and local import foundations. Security review, recovery testing, independent interoperability, and production migration coverage remain open.
Vault content will be encrypted on the device before syncing. Passwords, authenticator seeds, titles, domains, and tags belong inside encrypted content. The local encryption foundation is implemented; key handling and independent format interoperability remain under review.
CloudKit’s private database is the planned v1 sync path. Local encrypted storage must remain usable offline, during outages, and when the iCloud account or quota changes. Concurrent edits must remain recoverable.
Touch ID and Face ID development integrations provide convenient access on an authorized device. They are not a guarantee of recovery. Backup and recovery behavior must be tested and documented before public release.
Encrypted backups must restore on a fresh installation without iCloud. A portable export and a tested path into another application are release requirements. Your data should not depend on our website staying online.
No UnumVault vault backend is planned for v1. Necessary sync metadata and the final encryption design will be documented before launch.
Apple’s CloudKit private database documentationNo independent security audit has been completed. We’ll publish the scope and results of any review when it happens.
Validate the chosen engine, derivation, device-key storage, tamper detection, lock behavior, and interrupted writes.
Test lost-device scenarios and fresh-install restoration. State clearly what happens if all unlock material is lost.
Account for source items and files; check duplicate behavior, authenticator preservation, website matching, and extension access.
Exercise concurrent edits, deletion conflicts, retries, account changes, and quota failures. Review the security-sensitive code before public release.
For a security concern, email support@unumvault.app. Share reproducible behavior without including real passwords, seeds, or vault exports. The app’s formal disclosure process will be published before public release.
Support & release status