Architecture

Security & privacy, in full

"Private by design" is easy to print on a homepage. This page explains how your vault is actually encrypted, every request the app makes, what those requests contain and just as importantly, what it doesn't.

Last updated: July 17, 2026

The model in one line

Everything you add is encrypted on your own device and never leaves it. There is no server holding your stack, no account database, and no cloud copy: not as a policy, but as an architecture. There's nothing to breach because there's nothing there. The trade that comes with it: if you lose your credentials, nobody can let you back in. Not even me.

Encryption & key derivation

• Vault contents (pieces, prices, notes, collections) are stored as a single AES-256-GCM encrypted file.
• Photos are encrypted separately with AES-256-GCM under the same master key and held in IndexedDB, full-resolution. They are never written unencrypted.
• The master key is never stored. It only exists in memory while the vault is open, and is dropped on lock.
• What is stored is the master key wrapped twice: once by a key derived from your PIN, once by a key derived from your recovery passphrase. Both derivations use PBKDF2-SHA-256 with a per-user salt.
• The PIN derivation binds to your username + PIN together, so a PIN alone (or the right PIN with the wrong username) opens nothing.
• There is no password hash anywhere. A wrong PIN or passphrase is rejected because the AES-GCM authentication tag fails, not because a stored hash didn't match.

What leaves your device

The complete list. Every one is a read-only request, and none of them carry your holdings, your photos, your notes, an account, or a token, because none of those exist server-side.

The first four go to hollandia.the-vault.vip. In the apps, the brand fonts are bundled locally. The app makes no font request to Google or any third party on launch.

The honest part: a request is still a request. When your app asks for prices, my server (and Cloudflare in front of it, and GitHub for Windows updates) can see the connecting IP address, exactly as they would for any website visit. That's ordinary connection metadata, kept for security and troubleshooting, not used to profile anyone. So your stack is private and no account ties it to you, but "a device on this connection asked for prices" is not invisible. Anyone claiming total anonymity for an app that loads live data is selling you something.

Want your IP hidden too? Use the app behind a trusted VPN. It changes nothing about what the app sends, but your connection shows the VPN's address instead of your own. Optional. The vault is already private without it.

Where the app cannot go

• A strict Content-Security-Policy limits network access to self and hollandia.the-vault.vip only.
• On Windows the interface itself has no network access at all. Every outbound request is made by the app's main process and is host-allowlisted, with responses size-capped.
• No analytics, no telemetry, no advertising, no third-party scripts. Anywhere.

Platform hardening

Windows

• Screen-capture protection: screenshots and screen recordings of the vault window come out black.
• DPAPI key binding: key material is additionally wrapped to your Windows user + device, so keys copied to another computer are useless there.
• Auto-lock on Windows lock/sleep, plus an idle timeout you set (5–60 minutes).
• Developer tools disabled in release builds; navigation and pop-ups blocked outright.

Android

• FLAG_SECURE: blocks screenshots, screen recording, and task-switcher previews.
• Excluded from cloud and adb backup, so the vault can't be swept into a Google backup.
• HTTPS-only networking; WebView debugging off; root/tamper detection as an advisory warning.
• Background lock: the vault seals the moment the app leaves the foreground.
• Biometric unlock (optional, opt-in). An earlier version shipped with this disabled on purpose: a code review found the stored key wasn't truly bound to the hardware biometric prompt. That's fixed the right way now: the PIN sits behind a hardware Keystore key that requires a fresh fingerprint for every use, enforced by the security chip itself, not by app code. Enrolling a new fingerprint on the device destroys the key and the app falls back to the PIN, which always keeps working.

Backups & recovery

• Export produces one .hnv file containing the encrypted vault, the wrapped keys, and your already-encrypted photos. It is created only when you ask for it, and it goes wherever you put it.
• Import is whitelisted: a tampered or crafted .hnv can't inject arbitrary data into the app; the file is structurally validated first.
• Forgot your PIN? Your recovery passphrase gets you back in and lets you set a new one.
• Lost both? The vault is unrecoverable. There is no master key, no reset email, no backdoor. That is the design.

Treat the export like the vault itself. It's encrypted, so a lost USB stick isn't an open book, but see the limitation on the PIN below before you park it in a shared cloud folder.

Updates

On Windows, the app checks GitHub Releases for a newer version. Nothing downloads until you press the button, and the installer's SHA-512 is verified against the signed release manifest before it's applied, so a tampered download is rejected. Updating never touches your vault data. You can also verify the installer yourself: the download page checks the file's fingerprint locally in your browser.

On Android, updates arrive through Google Play like any other app.

Threat model

Honest limitations

The things a marketing page would leave out.

• A 6-digit PIN is a short lock. It's a convenience for opening the app on a device you already control. But because your exported backup can also be opened with that PIN, a person holding your backup file can try all million combinations offline at their own pace. The passphrase is the strong factor; the PIN is not. Keep exports somewhere private, and make your recovery passphrase a real one.
• The installer isn't code-signed. Windows will say "Unknown publisher". A certificate costs money this project doesn't have yet. Nothing is wrong with the file, but you shouldn't take my word for it, which is why the fingerprint check exists.
• It has not been audited by a professional security firm. The code has been reviewed repeatedly, including by several independent AI security reviews, and real issues found that way have been fixed. That is not the same as a paid human audit, and I won't pretend it is.
• It's built with AI assistance. I'm a stacker, not a professional developer. The code is written with Claude under my direction; every decision, and this policy, is mine. I'd rather say that plainly than imply a team that doesn't exist.
• It's beta software. Keep backups. Not because I expect to lose your data, but because you should never need to trust anyone that much, including me.