Your authorised device
Credential content stays inside the intended protection boundary.
CENTILIO VAULT / SECURITYUnderstand the boundary.
Understand the boundary.
Ask for the evidence.
A useful security conversation connects the intended design, the running version and the people responsible for it.
VAULT / DESIGN
Know what the boundary means.
- 01ContentsHow items are protected
- 02KeysWhere custody belongs
- 03EndpointsWhat remains at risk
Illustrative planning view · no account connected
VAULT / EVIDENCE
Match the claim to the release.
- 01VersionIdentify the deployed build
- 02AssessmentRead the scope and date
- 03FindingsReview unresolved work
Illustrative planning view · no account connected
VAULT / OPERATIONS
Protection needs an owner.
- 01RecoveryA rehearsed process
- 02MaintenanceUpdates and monitoring
- 03IncidentsA response path
Illustrative planning view · no account connected
THE PRIVACY PRINCIPLEKeep the secret.
Keep the secret.
Protect the handover.
Explore the intended boundary in three steps. This is an explanatory model, not a live encryption trace.
Nothing to transfer yet.
Start with the device and session you trust. This diagram contains no real password.
Protect the item locally
Credential content stays inside the intended protection boundary.
An encrypted representation
Vault describes client-side encryption. Verify the current implementation and key handling for your deployment.
Keep key custody explicit
Credential content stays inside the intended protection boundary.
Store the protected record
An encrypted database is one boundary, not immunity from compromised devices, weak credentials or implementation flaws.
Security is implementation-specific. Read the published architecture and findings ↗
FOR THE SECURITY BUYERTrust deserves evidence.
Trust deserves evidence.
Not just a label.
A focused review to take to your security team. Open each topic for the questions behind the decision.
01 / IMPLEMENTATIONWhat is running in this deployment?
Ask for the deployed version, key-handling design and current derivation settings. The published security page describes both a target algorithm and a migration state; confirm the implementation rather than relying on a headline.
02 / ACCESS AND RECOVERYWho can regain or change access?
Review role permissions, MFA enrolment, session revocation and recovery procedures. Test the intended path with a non-sensitive account.
03 / INDEPENDENT EVIDENCEWhat has actually been assessed?
Request the latest assessment date, scope, unresolved findings and remediation status. Public source or a security description is not an independent audit.
04 / OPERATIONSWho owns the operational work?
Agree hosting, backups, restore testing, retention and incident responsibilities. Self-hosting changes the owner of that work; it does not remove it.
RECOVERY / CONTINUITYPrepare for the day
Prepare for the day
that does not go to plan.
Review scenarios, not just settings.
A CLOSER LOOK / LOST DEVICE
Start with the documented recovery path.
A missing device changes the access problem; do not improvise with confidential material.
What this example means
Follow your organisation’s process. This preview does not revoke sessions or recover an account.
VAULT / ILLUSTRATIVE BRIEF
01
IdentifyAccount and affected device
02
ContainReview and revoke supported sessions
03
RecoverUse the approved recovery process
Sample context only. No account action is performed.
A CLOSER LOOK / TEAM DEPARTURE
Separate membership from exposure.
Removing a person is one step. The secrets they could have copied may need attention too.
What this example means
Revocation does not erase existing copies. Avoid assuming every provider invalidates every token identically.
VAULT / ILLUSTRATIVE BRIEF
01
MembershipReview collection access
02
SessionsReview active sessions and devices
03
RotationReplace exposed credentials where needed
Sample context only. No account action is performed.
A CLOSER LOOK / SERVICE RESTORE
Test the path back to service.
Treat recovery as an operational capability with evidence.
What this example means
A backup exists only as a useful recovery measure if the restore procedure works for the relevant version.
VAULT / ILLUSTRATIVE BRIEF
01
BackupKnown scope and retention
02
RestoreA tested non-sensitive environment
03
OwnerA named decision maker
Sample context only. No account action is performed.
PRIVATE REPORTINGRaise a concern.
Raise a concern.
Protect the evidence.
Use the verified official channel; keep secret values out of ordinary messages.
01What to include
Describe the affected version, expected and observed behaviour, timestamps and minimal redacted reproduction steps. Do not include passwords, recovery keys, session tokens or full credential exports.
02Where to send it
Open the official Vault security page for its private disclosure contact. Confirm the secure transfer method before sharing sensitive evidence. This page does not submit a report or promise a response time.
Official security page and reporting channel ↗ · reviewed 6 September 2026. This marketing preview is not a security assessment.
QUESTIONS / ANSWERED
A little more clarity.
Open a question, or search for what you need.
6 answers
What does client-side encryption protect?
It is intended to protect item contents before storage or transfer. Its strength depends on the running implementation, key custody, authentication and endpoints. It does not eliminate every attack or operational risk.
Which key-derivation algorithm is currently deployed?
The published security page describes Argon2id in its diagram and a PBKDF2-to-Argon2id migration in its findings. Ask for the exact deployed version and configuration; this preview does not resolve that inconsistency by assertion.
Is there an independent security assessment?
Request the latest report, assessment date, scope and remediation status. Public source or a security page is not evidence that the current deployment has passed an independent assessment.
Can support always recover a lost vault?
Do not assume that it can. Review the supported recovery model before onboarding and test it with non-sensitive data. Never send support a master password or recovery key.
Does removing a member remove every copy of a secret?
No. Revoke supported access and sessions, and rotate credentials that may have been copied or exposed according to your organisation’s process.
How should a suspected vulnerability be reported?
Use the private reporting channel listed on the official security page. Share minimal redacted evidence and ask for a secure transfer method before sending sensitive details.
No matching answers. Clear the search to see all questions.
THE NEXT STEPKeep the decision
Keep the decision
moving forward.
Explore the next page or bring your requirements to the Vault team.