Your family's information, protected.
Vaulto holds sensitive details — what you own, where it is, the documents that prove it. We treat that responsibility seriously. Here's exactly how we protect it, in plain language.
How we protect your data
Encrypted in transit.
Every connection to Vaulto uses TLS (HTTPS), so your data is encrypted as it travels between you and us.
Encrypted at rest.
Your information and documents are stored on encrypted infrastructure — managed database and object storage.
Passwords never stored plainly.
We hash your password with a strong, modern algorithm (scrypt) — even we can't read it.
Short-lived sessions.
Sign-in tokens are short-lived and kept in memory; the token that keeps you signed in lives in a secure, script-proof cookie.
Protected against abuse.
We rate-limit sign-in and other sensitive actions to defend against automated attacks.
Access controls.
You can only see and edit your own vault. Our systems enforce this on every request.
Our privacy promises
We never sell your data.
Full stop.
We don't share to advertise.
Your information isn't handed to third parties to market to you.
You're in control.
You decide what you add — and what you remove.
Your data is yours
Your data is yours — export everything (your data + your original files) at any time. From Settings, Download everything (.zip) gives you one file with a complete, machine-readable copy of your records plus every original photo and scan you uploaded. No lock-in, no waiting on us. The machine-readable export also satisfies your right to data portability under GDPR (Article 20).
Plain-language, no overclaim. We describe only what's true today: encryption in transit and at rest, hashed passwords, strict access control. We deliberately do not claim "zero-knowledge," "bank-level," or any certification we haven't earned. Data export is live (above). When we add app-layer encryption or a formal third-party audit, this page will say so. For privacy or security questions, contact privacy@myvaulto.com.