How Almirah keeps your documents private
Almirah is end-to-end encrypted. Your phone encrypts every document before it leaves the device, and only the people in your family vault hold the keys. Our servers store locked boxes they can't open.
If our servers were breached tomorrow
An attacker would get scrambled data. Here is everything we store, and whether we can read it:
| What we store | Can we read it? |
|---|---|
| Your scans and files | No. Encrypted on your phone before upload |
| Document details: title, number, holder, notes | No. Encrypted with the document |
| Your passphrase | No. It never leaves your phone |
| Vault and document keys | No. We only hold them locked to your family's own keys |
| Document type and due date | Only if you turn on server reminders |
| Your email, vault members, storage used, subscription | Yes. We need these to run the service |
Encryption
- Your passphrase is turned into a key on your phone with Argon2id. It is never sent to us.
- Each document gets its own random key and is encrypted with XChaCha20-Poly1305, so any tampering is detected.
- Document keys are locked with your vault key, and the vault key is sealed separately to each family member's public key.
- Document details (title, number, holder, notes) are encrypted too, not just the file.
- We use the widely reviewed libsodium library and no home-made cryptography.
Family sharing
- When someone joins your vault, you both see a 20-digit safety code. Compare it on a call or in person: if it matches, nobody (including us) has swapped in a different key.
- When you remove someone, the app changes the vault key so they can't open anything added later. Copies they already downloaded can't be taken back.
What our servers can see
Your email address, which vaults you belong to, how much storage you use, and your subscription. If you turn on server reminders, the document type and its due date. Nothing else. The full list is in our privacy policy.
Recovery
At sign-up you get a 24-word recovery key. It's the only way back in if you forget your passphrase. We can't reset it for you: that's the cost of us never holding your keys.
On your phone
- The app locks with Face ID, fingerprint or your passcode, and again after a minute in the background.
- The app switcher shows a blank screen instead of your documents.
- Opened documents are kept in memory, not saved as plain files.
Our side
- Everything travels over TLS. Servers and the database run in Singapore.
- Staff tools need two-factor sign-in, record every action, and can't open your documents or sign in as you.
Don't just take our word for it
- The safety code lets you check for yourself that nobody, including us, has slipped a key into your family vault.
- This website loads no third-party scripts, fonts or trackers. Your browser's developer tools will show you.
- The encryption code will be independently audited and published as open source before public launch, so anyone can check it does what this page says.
Report a vulnerability
Found a security issue? Email security@getalmirah.app. We'll acknowledge it within a few days and won't take legal action against good-faith research.