A vault that tells you who holds the key
Move private notes, photos and files into a vault that’s encrypted on your device before anything is sent. Passwords and logins are sealed with a key that never leaves your phone — we can’t read them, and can’t hand over what we never hold. Photos, documents and notes can optionally be stored under a key we do hold, so the same items open on your web dashboard. You choose, and the app says which is which.
Illustrative data — the server only holds ciphertext
Vault in one line
Anyone with documents, photos or notes they want kept genuinely private — off other apps’ camera rolls and out of reach of anyone but them.
Why it matters
Sensitive files end up scattered across gallery apps and note apps that sync in plaintext. A device-encrypted vault keeps them encrypted at rest on your device, so a server breach or a subpoena reveals nothing readable.
Key benefits
What you get
Two tiers, named
Passwords, logins and authenticator secrets are encrypted under a key that never leaves your phone. Photos, documents and notes can be put under a key we hold so they open on the web — opt-in, on paid plans, never for passwords.
Encrypted before it is sent
Nothing leaves your phone in the clear, either tier, and the item’s name is encrypted too. The one exception is a file you upload from a computer, which never touched your phone: a browser has no vault key, so it reaches us as the file and is encrypted here. Those items are marked.
Hardware-backed, auth-bound key
The AES-256-GCM key lives in the Android Keystore and can’t be exported. A biometric unlock authorizes it for a short window, then it re-locks.
Notes, photos and large media
Small items are stored inline; larger files are uploaded as encrypted blobs to our self-hosted store — no third-party object storage.
How it works
From tap to result
Unlock
Authenticate with biometrics or your device credential to authorize the vault key.
Encrypt on-device
Your note or file is sealed with the Keystore key before anything is sent.
Store ciphertext
Only the encrypted bytes are stored. A password is decrypted on your phone and nowhere else. A photo you chose to make web-accessible is decrypted on our server when you open it in a browser — and each time that happens is recorded in your audit log.
Where it fits
Everyday use cases
Real situations where vault earns its place.
Availability & plans
Questions
Vault, explained
Can Nexonix Systems read my vault?
What happens if I lose my phone?
How much can I store?
Get early access
Ready when you are
Get NexGuard free and see your whole security posture in minutes — no card to start, upgrade only if you want higher limits and the advanced engines.