The four layers of protection
AES-256 Encryption
Every item, photo, and location you save is encrypted using AES-256 GCM — the same standard used by governments and financial institutions worldwide. Everything is stored as an unreadable block of encrypted data.
Zero-Knowledge Architecture
Your encryption keys never touch our servers. We have no way to decrypt your data — not for support, not for advertising, not for any reason. If we can't see it, no one can take it from us.
Encrypted at Rest
All data is stored in an encrypted format on our servers. The cloud only ever holds the encrypted result — never raw photos, titles, or locations.
No Data Monetization
We don't sell your data, share it with advertisers, or use it to train models. Your inventory is personal. We make money from subscriptions — not from you.
What does encryption actually mean?
Think of encryption like a lock with a key that only you own. When you save an item in Once Kept, it is encrypted using AES-256 GCM and stored in a format that cannot be read without your credentials.
Our servers only ever store the encrypted version. Even if someone broke into our database, all they would see is meaningless noise — not your passport, not your documents, not your photos.
When you open the app and authenticate, your data is decrypted so you can view it. Without your credentials, it remains completely unreadable to anyone — including us.
Security FAQ
Can Once Kept employees see my items?
No. Because your data is encrypted with a key only you hold, it's technically impossible for us to view your items, photos, or locations — even if we wanted to.
Do I need to upload a photo of my actual document?
Not at all. You can photograph the envelope it lives in, the drawer it's stored in, or anything that helps you remember where it is. The app is about location — not about storing sensitive images you're not comfortable with.
What happens if I lose my phone?
Your encrypted data is backed up to the cloud. When you sign in on a new device with your credentials, everything is decrypted and your full inventory is restored.
Is my data safe if Once Kept shuts down?
Your data lives on your device and in your account. We're committed to giving users advance notice and data export options in any scenario that affects service continuity.
Reviewed by AI security models
We asked leading AI models to independently audit our encryption implementation. Here's what they found.
Prompt sent to each model
I'm building a mobile app called Once Kept. We store user images encrypted in a database. Please audit our encryption implementation and tell me:
1. Is the algorithm correct and secure?
2. Is the IV/nonce handling safe?
3. Is the auth tag being handled correctly?
4. Is there anything missing or that could be improved?
def encrypt_data(data, master_key_hex, aad=None):
key = hashlib.sha256(str(master_key_hex).encode()).digest()
aesgcm = AESGCM(key)
iv = os.urandom(12)
aad_bytes = aad.encode() if aad else None
ciphertext_with_tag = aesgcm.encrypt(iv, data, aad_bytes)
tag = ciphertext_with_tag[-16:]
ciphertext = ciphertext_with_tag[:-16]
return iv + tag + ciphertext
def decrypt_data(combined_data, master_key_hex, aad=None):
key = hashlib.sha256(str(master_key_hex).encode()).digest()
aesgcm = AESGCM(key)
iv = combined_data[:12]
tag = combined_data[12:28]
ciphertext = combined_data[28:]
aad_bytes = aad.encode() if aad else None
return aesgcm.decrypt(iv, ciphertext + tag, aad_bytes)
The master key is a 64-character random hex string stored as an environment variable. AAD is the user's ID. Please give a verdict per check (pass/fail/warning) and an overall rating.
Claude
Anthropic
"AES-256-GCM is correctly implemented with secure nonce generation and authentication tag handling. Key management and data binding have been hardened."
ChatGPT
OpenAI
Review in progress
Gemini
"The AES-GCM implementation is highly secure, correctly handling authenticated data binding and uniquely generating nonces."
Private by design.
Not by promise.
Security isn't a feature we added. It's the foundation everything is built on.
Download Once Kept