Row-level authorization
Every table enforces tenant and workspace membership in the database, including negative cross-tenant paths.
Security & trust center
We built Passkey-X assuming we could be breached.
Your data is encrypted before it leaves your device, with keys that never reach our servers. This page explains exactly how — and what we can and cannot see.
Key hierarchy
Five layers between an attacker and your secrets.
Every layer is created and used on your device. The server stores only the wrapped, encrypted output of each step.
Your login password and your vault password are separate. Signing in proves who you are; only the vault password decrypts.
- 1Vault passwordNever leaves your device
- 2Argon2id · 64 MiB · 3 passesDerives your master key on-device
- 3Account root keyWrapped by the master key and by your recovery key
- 4Workspace keysOne per vault; shared by wrapping to each member
- 5Items · AES-256-GCMEncrypted with context-bound AAD before sync
Cryptography
Standard, well-reviewed primitives. No homemade crypto.
- Key derivation
- Argon2id, 64 MiB memory, 3 iterations, per-account random salt. Clients reject weaker or oversized parameters.
- Item encryption
- AES-256-GCM with a fresh 96-bit nonce per write and additional authenticated data binding each item to its workspace.
- Key wrapping
- Account, workspace and device keys are wrapped with AES-256-GCM under domain-separated labels.
- Recovery
- A 256-bit recovery key generated on your device. Passkey-X stores only a verifier; it cannot recover your vault for you.
- Secure Send
- HKDF-SHA256 over a link key kept in the URL fragment (never sent to the server) plus an optional Argon2id passphrase.
- Audit integrity
- Each event is chained with SHA-256 over its content and the previous hash. Append-only for organizations; verifiable on demand.
Visibility
What we — and your admins — can see.
DataPasskey-XYour organization admins
Passwords, notes, files and custom fieldsNeverNever
Item titles, URLs and usernamesNeverNever
Workspace namesNeverNever
Your vault password or recovery keyNeverNever
That an item exists, its size and revision numberMetadata onlyNever
Counts of weak, reused or breached passwords (organizations)NeverYes
Audit metadata: who shared, revealed or changed what, and whenNeverYes
Platform controls
Defense in depth, from the browser to the database.
Phishing-resistant sign-in
Domain-bound passkeys and authenticator-app 2-step verification. Account sign-in never unlocks the vault on its own.
Hardened delivery
Strict Content Security Policy, HSTS, no framing, no third-party trackers, and no-store caching on sensitive routes.
Private breach checks
k-anonymity: only the first five characters of a SHA-1 hash leave your device, padded so response size reveals nothing.
Tamper-evident audit
Organization events are hash-chained, append-only and exportable as CSV or JSON evidence.
Memory hygiene
Keys are zeroed after use, the vault locks on idle and when the app is hidden, and clipboard copies clear automatically.
Compliance posture
Honest about where we are.
Passkey-X is not yet SOC 2 or ISO 27001 certified. Our admin console, policies, access reviews and hash-chained audit trail produce the evidence those frameworks ask for, and Enterprise customers receive architecture and data-flow documentation on request.
Responsible disclosure
Found a vulnerability? Tell us privately at security@passkey-x.com or through the form below, and give us a reasonable time to fix it before disclosure. Test only with accounts you own, and do not access other users’ data, run denial-of-service tests or degrade the service.
Safe harbor: if you act in good faith and follow these rules, we will not take legal action against you or ask others to, and we will work with you to understand and fix the issue.
Report a security issue Never include real passwords or recovery keys in a report. Questions
Security FAQ
Can Passkey-X employees read my passwords?
No. Your vault is encrypted on your device with keys derived from a vault password we never receive. Our servers store ciphertext.
What happens if Passkey-X is breached?
An attacker would obtain encrypted data and would still need to guess each user’s vault password against Argon2id with 64 MiB of memory per guess. Use a long, unique vault password.
Can my company admin open my vault?
No. Admins can enforce policies, manage access to shared workspaces and see aggregate risk counts, but cannot decrypt anyone’s items.
What if I forget my vault password?
Use the recovery key you saved during setup. Without it, nobody — including Passkey-X — can recover the vault.
Are you SOC 2 or ISO 27001 certified?
Not yet. Our controls are designed to support those frameworks, and customers receive audit exports and architecture documentation today. We will publish attestations here when they are complete.
Bring your security team.
We’ll walk through the architecture, threat model and audit evidence with your reviewers.