Zero-knowledge, end to end

The zero-knowledge promise

Zero-knowledge means the encryption keys that protect your vault are derived from, and controlled by, you — never us. Your master password is never transmitted to our servers, never stored, and never recoverable. What we hold on your behalf is a blob of ciphertext that is mathematically useless without your key.

If an attacker breached every server we own, exfiltrated every database, and read every log line, they would still find nothing but random-looking bytes. That is the design.

How encryption works, step by step

1. Key derivation. When you unlock, your master password is stretched through PBKDF2-HMAC-SHA256 with 250,000 iterations and a unique 128-bit salt to produce a 256-bit master key. This happens entirely in your device's memory.
2. Item encryption. Each vault item is encrypted individually with AES-256 in GCM mode using a fresh 96-bit initialisation vector. GCM provides both confidentiality and tamper detection.
3. Sync. Only the resulting ciphertext, IV and authentication tag are synced. Our servers store and relay these opaque blobs; they never see plaintext or keys.
4. Decryption. On another device you sign in, re-derive the same key from your master password, and decrypt locally. The key exists only while the vault is unlocked and is wiped from memory the moment you lock.

You can watch a faithful version of this pipeline run in your own browser on the Open Vault page — it uses the exact same Web Crypto primitives (PBKDF2 + AES-GCM) described above.

Defence in depth

Independent verification

Trust should be earned and checked. Celestial's cryptographic core and infrastructure are reviewed by independent third parties, and we align our controls with recognised standards:

• Annual third-party penetration testing with published summary reports
• SOC 2 Type II and ISO 27001 aligned control frameworks
• GDPR-first data processing with an EU-based Data Protection Officer
• A public bug-bounty programme — see below

Responsible disclosure & bug bounty

Security researchers are partners, not adversaries. If you believe you've found a vulnerability, email contact@celestialdatavault.com with the subject line [SECURITY]. We acknowledge reports within 48 hours, work with you on a fix, and reward qualifying findings. Please give us reasonable time to remediate before any public disclosure.

Radical transparency

We publish a live system status page, notify affected users of any security incident without delay, and will never introduce a backdoor, master key, or key-escrow mechanism. If that ever changed, our zero-knowledge design would make it impossible to do so silently — and we'd tell you first.