AES-256-GCM
Every secret, password, note and transcript is sealed with authenticated encryption before it touches the network.
KeyAuthySecurity
KeyAuthy is built so that losing the server would not lose your secrets. Encryption happens on your device, before sync, every time.
Every secret, password, note and transcript is sealed with authenticated encryption before it touches the network.
Your master passcode is stretched on-device into the vault key. The passcode itself is never transmitted or stored.
Sync stores opaque blobs. Nobody operating the backend — including us — can read a token, password or recording.
Platform passkeys wrap the vault key with hardware-backed biometrics, with the master passcode as fallback.
The vault re-locks on idle and after restart, and copied codes are cleared from the clipboard automatically.
Change your passcode and every stored row is re-encrypted with a fresh salt, row by row, with visible progress.
Access control
Sign-in is limited to the owner account and approved teammates on the clinic domain — everyone else is rejected at the door.
Database policies scope every row to its owner, so an authenticated session still cannot reach another vault.
Recovery
Because the passcode never leaves your device, it cannot be reset for you. Export an encrypted backup file and store it somewhere safe; restoring needs only that file and your passcode.