Security & architecture
How Veridenti protects your data — the details your security team will ask about.
Zero-knowledge, end to end
Your vault contents are encrypted on each device with AES-256-GCM. The server stores only ciphertext, a one-way authentication hash, and a salt — it can never decrypt your data. This isn't a policy promise; it's the architecture. Not even Veridenti, under any request, can read your vaults.
Keys
- The personal vault key is derived on-device from the master password using PBKDF2-SHA256 (310,000 iterations) with a unique salt and domain separation, and is never transmitted to Veridenti.
- Shared/team vaults use a per-vault key (SVK) that is wrapped to each member's public key on-device (ECDH-ES + HKDF-SHA-256). Sharing and revocation never expose an unwrapped key to the server.
- A fresh random 12-byte IV is used per encryption operation.
In transit & at rest
All traffic uses TLS. Autofill is withheld on non-HTTPS pages. Blobs at rest are region-pinned ciphertext (see Data residency).
Recovery
Because we can't decrypt your vault, recovery relies on keys you hold — a recovery key for personal accounts, and organization recovery controls for enterprise. Losing both your master password and recovery key means the data is unrecoverable by design.
No phone-home
Veridenti does not phone home by default. Where telemetry is offered, it is opt-in.