Security at KeepSafe.What we do, in plain words.
You are trusting KeepSafe with the keys your products run on. Here is how we look after them, and what you can check for yourself.
Encryption
Every credential is encrypted under a key of its own before it is stored, so a copy of the stored data alone reveals nothing readable.
Revealing a secret
A secret is shown only after you enter your reveal PIN, which is separate from your password. Repeated wrong guesses pause revealing for a while, and every reveal is written to the credential’s history.
Signing in
Add two-step sign-in with an authenticator app and backup codes, or sign in with a passkey. Sessions expire on their own, and you can see and end each one from your settings.
Your activity
Sign-ins, security changes and reveals are recorded with the device and the country they came from. A sign-in from a new country raises an alert.
Access by our team
Our team has no standing access to your vault. If you ever need help recovering access, any access is limited in time, needs your consent, and appears in your history.
In transit and at rest
Every connection to KeepSafe is encrypted with TLS, and stored data sits on encrypted storage, on top of the per-credential encryption above.
In your browser
The app loads no analytics, advertising or third-party scripts, and a strict content security policy limits what the page can talk to.
Found something?
If you believe you have found a security issue, we want to hear about it. Our responsible disclosure policy explains how to report it.