Security: What Protects What

What keeps your vault private, what Apple can still see, and what no app can protect against.

Encrypted on your device

Everything in the vault is encrypted on your iPhoneiPad before it's saved: photos, videos, documents and scans, their previews, names, albums and dates, the text recognized in scans, and the search index. The vault has its own random key, and your password locks that key. We don't have your password, so we can't read your content. The key is unlocked only in memory; wherever it's stored, on the device or in the Keychain, it's locked.

Opening the vault

• Each wrong password makes the next try wait longer. The wait is kept in the device's Keychain, so restarting or reinstalling doesn't skip it.
• After you unlock, SilentBox tells you how many failed attempts there were since you last unlocked. It remembers only their times: no photo, no location.
• SilentBox never erases the vault after a number of wrong tries. The person most likely to type a wrong password ten times is you.
• Your recovery phrase is the only way back if you lose your password. Lose both, and the vault can't be opened by anyone, including us.

While the vault is open

• The vault always locks when you leave the app, and after 30 seconds without use unless you change Auto-Lock.
• The app switcher never shows what was on the screen.
• With Block screen capture on, screenshots come out black and the vault is hidden while the screen is recorded, mirrored or shown with AirPlay. iOS doesn't guarantee this, and nothing stops a camera pointed at the screen. See Hide from screenshots.
• A locked album is a lock in the app, not a second layer of encryption: its items use the same key as the rest of the vault. It protects them from someone holding your unlocked iPhoneiPad, not from forensic tools.

iCloud

iCloud sync is off until you turn it on, and until then nothing leaves the device. When it's on, only encrypted data goes into your own private iCloud database, the same data that's on your device. Apple can't read your content, previews, names, recognized text or search index. SilentBox has no servers of its own.

The key never goes into that database. A wrapped copy travels through iCloud Keychain so your other devices can open the vault, and even that copy opens only with your password or recovery phrase. SilentBox relies on Apple's end-to-end encryption of iCloud Keychain; that is Apple's promise, not something SilentBox can check. Without iCloud Keychain, the vault can't be opened on another device, not even with the recovery phrase.

Apple can still see:

• your Apple Account;
• roughly how many items the vault has, and the size of each;
• when each change happens;
• how many devices share the vault, and what kind;
• your IP address and how much data is transferred.

Someone watching the network can see that data is syncing and how much, but not what it is.

Nothing collected

SilentBox has no analytics, no tracking and no third-party code that sends data anywhere. There's no account to create. Nothing about you or your vault is sent to us.

Backups and exports

• The vault is left out of iPhoneiPad backups, so restoring the device from a backup doesn't bring it back. It comes back through iCloud from another device, or from an encrypted archive.
• An encrypted archive has its own password. Files you export aren't encrypted.
• An archive that was cut short can restore without an error. After a restore, check the number of items. See Restore from an archive.

What nothing can protect

• Being made to unlock. Whoever makes you open the vault sees everything. SilentBox has no second password that opens a harmless-looking vault instead.
• A compromised device. Malware or a modified iOS can read the key while the vault is open.
• Someone looking. While the vault is open, anyone who sees the screen, or films it, sees what's on it.
• A lost device that has already opened the vault. It can't be cut off remotely. Change Password stops the old password from working anywhere, but the lost device keeps its own key; its passcode and remote erase protect it. See If you lose a device.
• An old copy of the Keychain. Changing your password doesn't re-encrypt the vault. Someone with a copy of the Keychain from before the change and the old password could still open it.
• A password you give away, willingly or not.