Zero-Knowledge by Design

Our server cannot read your vault data. Only you hold the key.

🔐 Client-Side Encryption

All vault data — your digital accounts, contact details, and estate packets — is encrypted in your browser before it ever reaches our servers. We store only encrypted blobs that are meaningless without your key.

This is true zero-knowledge architecture. Even if our entire database were compromised, attackers would find only encrypted data they cannot decrypt. No passwords, no plaintext, no readable content.

🔑 Vault Access Token (EAT)

When you create your vault, you receive a 256-bit Vault Access Token — a cryptographic key generated in your browser. This token wraps your vault encryption key using PBKDF2 (600,000 iterations) and AES-256-GCM.

Your Vault Access Token is never transmitted to or stored on our servers. It exists only where you save it — offline, in your possession. Think of it like a crypto seed phrase: lose it, and the data is irrecoverable by design.

This separation means: even we cannot help you recover your vault if you lose the token. Your security does not depend on trusting us.

🛡️ Encryption Standard

AES-256-GCM — the same authenticated encryption algorithm used by governments and financial institutions for classified data. GCM mode provides both confidentiality and integrity verification — if a single bit is tampered with, decryption fails.

• 256-bit key length (2²⁵⁶ possible combinations)
• 96-bit initialization vectors (unique per encryption)
• 128-bit authentication tags (tamper detection)
• Web Crypto API (browser-native, hardware-accelerated)

👤 Executor Access Model

Your designated executor can access your vault using a four-factor verification process:

1. Vault Reference Code (from your estate packet)
2. Registered email address (stored as irreversible SHA-256 hash)
3. Registered phone number (stored as irreversible SHA-256 hash)
4. Your Vault Access Token (decrypts the vault client-side)

The executor decrypts your vault entirely in their browser. Our server facilitates the connection but never sees the decrypted content. Access is time-limited (30 minutes) and auto-expires after 24 hours.

🚫 What We Cannot Do

• We cannot read your vault items, estate packets, or contact details
• We cannot recover your data if you lose your Vault Access Token
• We cannot grant access to anyone without the correct EAT
• We do not store passwords to your external accounts
• We do not log into any third-party platform on your behalf

🔒 Protection Layers

• Authentication: Clerk-managed sessions with multi-factor authentication support
• Rate Limiting: IP-based rate limiting on sensitive endpoints (hashed IPs in database)
• Brute Force Protection: Automatic lockout after failed executor verification attempts
• CSP Headers: Content Security Policy restricts which scripts can execute
• HSTS: HTTP Strict Transport Security enforces encrypted connections
• Audit Trail: Complete encrypted history of all vault operations
• Session Timeout: Vault key cleared after 30 minutes of inactivity
• Auto Sign-Out: Full session cleared after 3 minutes of tab inactivity

📞 Security Contact

For security questions or to report a vulnerability responsibly, contact us at admin@jumppointlegacy.com with "Security" in the subject line.