A Vault where you choose
Each Vault is rooted in a local folder selected by you. Multiple Vaults can separate personal archives, creative work, or other contexts without combining every sensitive file into one library.
Security without theatre
Know the boundary.
Then decide.
DeskVault is designed to protect private files at rest and reduce unnecessary plaintext copies during everyday use. This page explains the model in direct terms—including what sits outside it.
What DeskVault protects
Six layers, one understandable job.
The layers reinforce each other. Encryption protects stored material; locking controls access to the app; built-in reading and playback help you avoid creating extra readable copies.
Content, names, and headers
DeskVault uses authenticated content encryption with per-file keys. Original filenames and sensitive header metadata are stored inside the protected record rather than serving as a readable directory.
Password and Touch ID
An app password gates the workspace. Touch ID can make routine unlocking faster. Automatic locking can respond to idle time or the app moving into the background.
Selective encrypted backup
Backup is a per-Vault choice. Eligible encrypted files can be stored through iCloud and used to restore missing local files. This is a recovery path, not continuous two-way mirroring.
Paired local-network import
DeskVault can receive files over a local network using pairing, with encrypted transfer available. The goal is to move material into the Vault without routing it through an unrelated public upload service.
Work without routine export
Supported PDFs, images, audio, and video can be opened inside DeskVault. Keeping common viewing tasks in the app reduces—but cannot eliminate—the chance of forgotten readable copies.
Access control in context
Encryption is only useful if re-entry is deliberate.
A password and biometric convenience are paired with automatic locking. The intent is simple: a Vault should not remain casually open because you walked away or switched to another task.
Failed password attempts are limited by a temporary lockout. Touch ID relies on the Mac’s biometric authentication. Neither mechanism replaces good device security: use a strong macOS login password, keep FileVault enabled, and install operating-system updates.
What DeskVault does not protect
There is no honest security model without limits.
A file after you export it
When you deliberately export a readable copy, that copy leaves the Vault boundary. Its destination folder, the application that opens it, backups of that destination, and any later sharing are governed by those systems—not DeskVault.
Someone acting through an unlocked session
If your Mac and DeskVault are already unlocked, a person with control of that session may be able to view or export what you can. Automatic locking narrows the window; it cannot make an actively compromised session trustworthy.
Every trace created by other software
Preview caches, screen recordings, screenshots, clipboard contents, and documents opened in other apps may create their own data. Staying in DeskVault for supported viewing tasks reduces routine exposure, but it is not a system-wide anti-forensics tool.
Failures outside the tested model
We do not claim independent certification, anonymity, or immunity from every future vulnerability. Keep recoverable backups, protect your Mac, and choose a workflow appropriate to the consequences of loss or disclosure.
Backup, not mirroring
A recovery copy should not pretend to be sync.
The words matter because they create different expectations when a file changes, disappears, or is opened on another device.
| Behavior | Selective encrypted backup | Real-time two-way sync |
|---|---|---|
| Primary purpose | Recover missing encrypted files | Keep several locations continuously aligned |
| Selection | Chosen per Vault and file eligibility | Usually follows the synchronized folder |
| Remote editing | Not the model | Often expected |
| Deletion semantics | Restore-missing-files behavior is explicit | Deletion may propagate to every location |
Recovery still needs testing
Whatever tool you use, keep at least one recovery path you have actually tried. A backup that has never been restored is still an assumption.
Choose with context
Security should survive a plain-language explanation.
Continue with the practical guides, or view DeskVault on the Mac App Store.