SECURITY, IN PLAIN ENGLISH
Thoughtful protection, without making everyday access feel complicated.
Your vault is encrypted on your device using AES-GCM through Apple’s CryptoKit framework. Items, attachments, category templates, and saved history are part of the encrypted vault.
A random vault key protects that data. Your master password protects a wrapped copy of the key, using PBKDF2-HMAC-SHA256 with a per-vault salt and 600,000 iterations. ArcaMea uses Apple Keychain for device key storage.
A new vault requires a master password of at least 12 characters. Choose a long, unique password you can keep safe.
Touch ID, Face ID, and PIN unlock are optional, depending on the device. These options are configured on each device; they do not replace the importance of remembering the vault’s master password.
A local vault stays on the device where it is created. An iCloud vault syncs its encrypted file using Apple’s iCloud Drive. iCloud and Keychain availability depend on your Apple Account and device settings.
ArcaMea does not operate a server that stores your vault contents. Learn more about the data involved in iCloud and website icon requests in the privacy policy.
Sensitive fields are masked by default. Reveal a value when you need it, copy it directly, or configure automatic locking and clipboard clearing in Security settings.
When you export an attachment, the exported file is outside the vault and is no longer encrypted by ArcaMea. Keep exported copies in a place you trust.
Encrypted backups let you preserve your vault separately from the active file. Restoring a backup requires the master password associated with that backup.
Support cannot recover a forgotten password or decrypt your vault for you. Keep your password and a usable backup somewhere safe before replacing devices or deleting a vault.
Contact support@arcamea.us. Please describe the issue without sharing passwords, keys, or private vault contents.
