Privacy, security boundaries & current limits
What protects vault data
- HTTPS/TLS protects data in transit.
- Database storage is encrypted at rest; designated sensitive fields and uploaded files receive application-level encryption.
- Passwords are hashed rather than stored in plaintext.
- Mandatory MFA and expiring server-side sessions protect account access.
- Every vault entry is gated by an active membership, then tenant data is scoped by vault with database row-level security.
- Vault and platform audit records are separate.
- Deleted items are kept indefinitely. Nothing removes them on a schedule — a deleted item remains recoverable until a Vault Admin restores it or purges it permanently.
Current product boundaries
- The platform operator cannot browse customer items, photos, documents, or monetary reports from the Super Admin Console.
- A full vault export package is planned but not currently available.
- Billing and subscription checkout are not currently enabled.
- Reports are the predefined set described in this guide; there is no custom report builder.
- The Vault security page shows the platform password policy; per-vault password-policy customization is not available.
- Zero-knowledge encryption is a future option, not the current key model.
- There is not currently a Member/Admin-facing page for browsing the raw vault audit log, although operations are recorded internally.
Glossary
| Term | Meaning |
|---|---|
| Account | One global identity: email, password, name, MFA, and sessions. |
| Vault | A private customer space with isolated items, users, locations, and reports. |
| Membership | The link between an account and a vault; stores role and active access. |
| Member | Day-to-day vault user without Admin settings. |
| Vault Admin | Member capabilities plus configuration, access management, and recovery controls. |
| MFA / 2FA | Authenticator-code second step required for vault access. |
| Recovery code | Single-use backup code for MFA sign-in. |
| Item code | Automatic vault-local identifier such as INV-00001. |
| Move item | Audited movement from a current location to a destination. |
| Status | An item's lifecycle state: Active, Inactive, or Gifted. Every item has exactly one. |
| Inactive | Retained item/person/config record hidden from the active default view. |
| Gifted | Item lifecycle state with recipient/date record. |
| Deleted | Soft-deleted item, hidden from normal lists and recoverable by an Admin. Deletion is separate from status — a deleted item keeps the status it had, and is retained indefinitely until an Admin restores or purges it. |
| Purge | Permanent deletion with no restore. |
Admin launch checklist
- Confirm the vault display name and accent color.
- Review default locations; add custom storage locations and order them.
- Review default item types; add useful subtypes and document types.
- Set the default currency and inactivity timeout.
- Confirm every existing account has completed MFA enrollment.
- Invite at least one additional trusted Admin so the vault is not dependent on one person.
- Send each invitation security code out-of-band.
- Add a small set of representative items, photos/documents, and movements, then review all Reports.
- Test recovery codes and store them securely.