Vaultine for Whistleblowers — Keeping a Record Intact and Deniable

Situations this covers

—Documentation that has to stay intact until it reaches a lawyer, a regulator, or a journalist.

—A personal phone or laptop that could plausibly be inspected before you are ready to come forward.

—A device that could be lost, taken, or wiped, taking the only copy of the record with it.

—Not wanting an account, an email address, or a subscription that ties the material to your name.

—Needing to bring in a large set of documents at once rather than a file at a time.

What does the work

No account or email to sign up

There is no sign-up, no email, and no subscription record tying a vault to your identity.

Zero-knowledge design

The key is derived from your code on your device and never leaves it. We hold no key and no copy, so there is nothing on our end that could be requested or handed over.

Encrypted backup to your own Dropbox

Optional, and encrypted before it leaves the device, so a copy exists somewhere other than the device you carry. This is the feature that matters most here.

Decoy Vault

A second code opens a separate vault stocked with files you chose, so a device check produces something ordinary while the real vault stays closed.

Folder import

Bring in an entire directory at once, structure intact, rather than adding documents one at a time.

12-word recovery phrase

Access to the vault does not depend on the device surviving, or on anyone else's system staying available.

Preservation first, not destruction

Most of what gets written about coercion-resistant vaults assumes the goal is making files disappear. Here it usually isn't. A record that gets wiped under pressure has failed at the only job it had, which was to still exist when it reached someone able to act on it.

So the two features that matter most in this situation are the quiet ones. Encrypted backup to your own Dropbox means a copy exists somewhere other than the device in your pocket, encrypted before it leaves, and unreadable to Dropbox or anyone else without your key. The 12-word recovery phrase means access doesn't depend on that device surviving either.

Why the Duress Vault is the wrong default here

Vaultine has a Duress Vault: a code that opens an empty vault, wipes your real vaults, and then becomes your main vault so nothing suggests the others existed. It is a genuinely strong tool, and for some people it is exactly right.

For preserving documentation, it usually isn't. Destroying the record under pressure is the outcome you are trying to avoid, not the one to automate. The Decoy Vault is the fitting feature: a second code opens a separate vault stocked with files you chose, so an ordinary device check produces an ordinary result while the real vault stays closed and intact.

Both exist, both are configured by you, and it is worth deciding deliberately which one you actually want set up rather than enabling the more dramatic option by default.

Nothing to subpoena on our end

Vaultine has no account system, no email sign-up, and no server holding your files or your encryption key. The key is derived from your code on the device and never leaves it. That's a factual description of the architecture, and its practical consequence is that there is no vendor-side copy of anything for anyone to request.

The one connection worth stating plainly: the app registers the device once on first install for licensing and install metrics. That check-in carries no account, no email, and no file contents, but "the app never connects to anything" would be an overclaim, so we don't make it.

What this does not do

Software can encrypt a file. It cannot tell you whether disclosing something is lawful where you are, whether an internal channel is safe to use, or what protections you may or may not have. Those are questions for a lawyer or an established disclosure body, and they are better asked before acting than afterwards. Vaultine is a tool for keeping a record intact and unreadable to others in the meantime. That's the whole of the claim.

The bottom line

Be clear about what this is. Vaultine protects files. It does not protect you, it is not legal advice, and it cannot tell you whether disclosing something is lawful or safe in your situation. Those questions belong with a lawyer or an established disclosure channel, ideally before you act rather than after. What the software can do is narrower and still worth having: keep a record encrypted, keep it deniable during an ordinary device check, and keep a copy that survives if the device you carry does not.

Frequently asked questions

What happens to my files if my device is taken or wiped?

If you turned on encrypted backup to your own Dropbox, an encrypted copy exists independently of the device, and your 12-word recovery phrase restores access to it. The backup is encrypted before it leaves the device, so Dropbox cannot read it either. Without a backup, the vault lives on that one device only.

Does Vaultine know who I am, or hold anything that could be handed over?

There is no account, no email sign-up, and no server holding your files or your encryption key. The key is derived from your code on your device and never leaves it, so there is nothing on our end to compel. The app does register the device once on first install for licensing, which carries no account and nothing that identifies you personally.

Should I use the Duress Vault for this?

Usually not. The Duress Vault wipes your real vaults, and documentation you are preserving is the one thing you generally do not want destroyed. The Decoy Vault is the feature that fits this situation: it diverts a device check without touching the real vault. Duress is available if your circumstances genuinely call for it, but it is the wrong default here.

Can I bring in a large set of documents at once?

Yes. Folder import brings an entire directory in with its structure intact, and bulk operations are built for moving a lot of files in one pass rather than a few at a time.

A record only matters if it survives long enough to reach someone who can act on it.