Security Principles
What we protect — and what we cannot
CivicVault is engineered against the threats that matter to public-interest professionals. We do not claim to be unhackable, anonymous, or government-proof.
Authentication
- Scrypt-hashed passwords/passphrases.
- TOTP multifactor authentication (required for members).
- Passkeys & hardware security keys — on the roadmap.
- Login throttling, rate limits, and abuse detection.
- Alerts for new devices and suspicious activity.
Sessions & devices
- Device-bound sessions with cryptographic device identity.
- Remote device revocation and "log out everywhere".
- Device security states (ACTIVE → SUSPICIOUS → QUARANTINED → BLOCKED).
- Tamper-evident, hash-chained audit log of administrative actions.
Data protection
- Encryption in transit (TLS) and at rest.
- End-to-end encryption between member devices for private messages; the server relays ciphertext.
- Encrypted file objects; the server has no key to read them.
- Identity/verification records separated from profile data.
- Minimal logging; short documented retention; IP anonymization.
Administration
- Least-privilege roles: verification, security, support.
- Every administrative action audit-logged.
- No routine administrative access to encrypted message contents.
- Documented incident response; independent review planned before each production phase.
Honest limits: we cannot protect a compromised device that holds your keys or reads your screen; we cannot prevent screenshots by a recipient; we are subject to lawful jurisdiction. We state what we can and cannot do — see
Government Data Request Policy.