Vando
Security
One failure shouldn’t become every failure.
No system is unbreakable, and we won’t claim ours is. Vando is designed so that losing one thing, your phone, a password, even our servers, doesn’t hand over everything. These are the design goals for the first release; the full security design will be published before anyone is asked to trust it with real secrets.
What we’re building in
- We can’t read your vault.Your items are encrypted on your devices with a key made from your passkey. Our servers keep scrambled copies they can’t open.
- We can’t approve for you.Every approval is signed on your phone over the exact thing asked. A breach of our servers can’t invent one or change an amount.
- Locks per item.Your face for everyday things; add a security key, a person or a wait for the ones that matter. Rules have minimums nobody can lower.
- Weakening is slow, strengthening is instant.Removing a key, turning a lock down or alerting fewer places waits a day (or needs your key), and your other devices are told.
- No email reset around a strong lock.Getting back in uses your recovery kit, another device or people you chose, with a wait your old devices can cancel.
- Receipts for everything.Who asked, for what, who approved on which device, and whether a secret was shown, lent or never revealed.
If something goes wrong
| What happens | What it could get | What stops the rest |
|---|---|---|
| Your phone is stolen, unlocked | Items locked with only your face or passcode | Items that also need your key, a person or a wait. Cut the phone off from any computer. |
| Our servers are breached | Scrambled vault copies and account details | No key to open them; approvals need your phone’s signature. |
| Your email is taken over | Alerts and the ability to start a recovery | Recovery needs your kit, a device or your people, and waits while your devices can cancel. |
| An AI agent goes rogue | What you let it do without asking | Risky actions and secrets ask your phone; pause cancels everything at once. |
| Someone fakes your mum’s voice | Your trust, if you don’t check | “Is this really Mum?” asks her phone, not her voice. |
Honest limits: a Vando app update we ship could be malicious; someone who knows your phone passcode can open anything locked only with it; and a secret shown to a person can’t be un-shown. The design says each of these out loud where it matters.
What if Vando disappears?
Your data is yours. You can export everything, any time, in open formats, and your recovery kit works without us. We’d rather you trust us because leaving is easy.
Built on the platform, not around it
Face ID and fingerprints are your phone’s own. Keys live in its secure chip. We don’t store biometrics, and we don’t use voice as proof.