NullVault reduces specific risks; it does not eliminate every way private data can be exposed. The most important boundary is the moment of use: if the device, operating system, or app process is compromised while a vault is unlocked, an attacker may observe the pattern, keys, screen, or plaintext despite strong encryption at rest.
A compromised device can observe an unlock
NullVault assumes the operating system and app sandbox are functioning when you unlock. Root access, a jailbreak, malicious instrumentation, spyware, hostile accessibility control, or a compromised keyboard/display path can defeat that assumption.
Hardware-backed key storage and app sandboxing raise the cost of offline attacks. They do not make a hostile running system trustworthy. If you believe a device is compromised, do not unlock sensitive vaults on it.
A pattern can be guessed or observed
Patterns are memorable, which also makes common shapes predictable. A memory-hard key-derivation function slows guesses; it does not convert a familiar shape into a random secret.
Use a longer, uncommon pattern. Shield the screen while drawing it, avoid reusing a phone-unlock gesture, and assume that someone who saw you unlock may remember the movement.
Hidden is not invisible
NullVault avoids a normal, user-visible master list and addresses separate vaults through separate patterns. That can reduce accidental discovery and limit what one disclosed pattern reveals.
It does not hide the fact that NullVault supports multiple vaults. App installation, encrypted files, storage allocation, quota behavior, timestamps, cloud requests, filesystem history, or repeated snapshots may expose activity or correlations. A determined person may continue to suspect that another vault exists even without a list.
Deletion is not guaranteed physical erasure
Phones use flash storage with wear leveling, snapshots, caches, and controller-managed copies. Overwriting a logical file does not prove that every physical copy disappeared.
In NullVault, ordinary deletion removes an item from the current active inventory. Older encrypted generations, filesystem history, backups, exports, or previously shared copies may remain. Removing an original from the system photo library is also an operating-system deletion, not a verified physical wipe.
Do not interpret “delete,” “reset,” “panic,” or “duress” as a promise to erase every historical copy.
Duress protection is local and forward-looking
NullVault's duress design is intended to keep a designated benign vault and invalidate other local vault access under its documented device assumptions. It is a destructive, high-consequence action—not a remote wipe.
It cannot:
- revoke plaintext or keys already captured by an attacker;
- erase an export on another device;
- guarantee physical erasure from flash;
- promise removal of prior cloud backups or snapshots;
- protect a person from continued coercion or legal consequences.
Laws concerning key disclosure, evidence, deletion, and duress features differ. Nothing on this site is legal or personal-safety advice.
Recovery creates authority as well as resilience
A recovery phrase or sharing phrase is a high-value secret. Anyone who obtains it may gain the authority defined by that flow. NullVault cannot reset or retrieve it.
On Android, the device-recovery phrase only replaces a forgotten pattern while the vault remains on the original device. Portable recovery requires a valid encrypted backup file and its separate backup recovery phrase.
On iOS, each vault's 24-word recovery phrase is used for local recovery and encrypted iCloud backup restore. A sharing phrase grants the separate authority described by that shared-vault flow and should not be confused with the recovery phrase.
Losing a device, every valid backup, or the required phrase can make data permanently unavailable.
Exports leave the vault boundary
Once you deliberately export, share, or copy content, the recipient or destination may retain it outside NullVault's control.
Before exporting, check the destination, its backup behavior, and who else can access it.
Browser PDF tools create derivatives, not authenticity
NullVault's PDF tools process supported files in the current browser and do not send document bytes to a processing API. That boundary avoids a server-upload workflow; it does not make an untrusted browser, extension, operating system, or device safe.
Most PDF transformations create new bytes. Reordering pages, changing page boxes, adding a password, compressing, filling forms, stamping, or annotating a document can invalidate an existing digital signature. The tools detect common PDF signature records and keep signed documents read-only for mutating operations, but detection is not certificate validation and cannot establish who signed a file.
The public editor adds visible annotations only. It does not rewrite hidden glyph codes, preserve a signed document's authenticity, or promise that changes will evade forensic review. Permanent redaction uses a new image-only PDF and deliberately omits the source PDF's text, forms, links, scripts, attachments, metadata, tags, and accessibility structure. Users must still inspect the downloaded copy and protect the original and every earlier copy.
Availability is not guaranteed
Corrupt storage, interrupted operations, insufficient device space, platform defects, account changes, cloud outages, quota restrictions, or losing recovery material can prevent access. Authenticated formats intentionally reject damaged or modified state rather than attempting unsafe recovery.
Maintain a tested recovery plan for data you cannot replace. Never keep the only recovery phrase beside the only device or backup it protects.
Questions people ask
Can NullVault protect me from spyware?
Not reliably if spyware can observe the screen, memory, touch input, or app process during unlock. Keep the operating system current and avoid unlocking on a device you do not trust.
Can anyone prove how many vaults I have?
NullVault makes no universal proof-resistance claim. The normal interface has no master list, but live compromise, app state, filesystem history, repeated snapshots, quotas, or service metadata may reveal information about usage.
Is deleted content unrecoverable?
NullVault removes deleted content from the active vault view, but it does not guarantee physical flash erasure or deletion from historical snapshots, backups, exports, or recipient devices.
Will Android panic wipe remove my exported backup?
No. Panic wipe invalidates future local access by removing required Android Keystore material. It does not erase exported encrypted backups, system snapshots, or every previously written physical storage cell.
Is a recovery phrase enough if I lose everything else?
Not necessarily. Recovery authority does not create missing ciphertext. Follow the platform-specific recovery instructions and keep valid backup material where the design requires it.
Limitations reviewed: 1 September 2026.