Best Practices

This page provides practical security recommendations for getting the most out of Necron Vault Manager's protection.

Key Management

Use a Key Drive for Sensitive Data

The single most impactful security decision is using a Pro tier Key Drive instead of a software key. A physical Key Drive:

• Cannot be remotely copied or stolen
• Requires physical possession to decrypt
• Can be stored in a safe when not in use
• Supports backup copies on separate USB drives

Create Backup Key Drives

Pro users can create up to 5 backup Key Drives that share the same encryption key. Store at least one in a separate physical location:

• One at home
• One in a bank safe deposit box
• One with a trusted family member

If your primary Key Drive fails, is lost, or is stolen, a backup Key Drive provides full access to all your encrypted data.

Protect Your Software Key (Free Tier)

If you're using the Free tier:

• Do not reinstall your OS without first decrypting critical files — the software key is tied to your user profile
• Keep backups of important files in their unencrypted form somewhere safe
• Consider upgrading to Pro for truly important data

Vault Configuration

Use Multiple Storage Locations

Configure at least 2–3 storage locations for each vault, ideally across different providers:

Mix Provider Types

Don't put all locations on the same provider. Use a combination of:

• One local folder (fast, always available)
• One or two cloud folders on different providers (off-site backup with diversity)

Enable Vault TOTP for Critical Vaults

For vaults with highly sensitive data, enable TOTP authentication. This adds a knowledge factor (authenticator code) so that physical possession of the Key Drive alone isn't enough.

Operational Security

Run Health Checks Regularly

Make it a habit to run health checks on important vaults, especially:

• After any incident — power failure, crash, cloud sync error
• Before creating backups — verify integrity first
• Periodically for critical vaults

Keep Cloud Sync Clients Running and Files Local

Cloud locations require the sync client to be active and all files to be saved locally on the device. The cloud folder must be mounted on your filesystem and configured to keep files on disk (not on-demand or streamed). If the client is paused or files are not stored locally, changes won't replicate and self-healing can't work for that location.

Don't Modify Encrypted Files Manually

Never manually move, rename, copy, or delete files inside vault directories. Use the Vault Browser inside the app instead — manual file operations will trigger tampering detection.

Keep the App Updated

Always use the latest version of Necron Vault Manager for security patches, bug fixes, and improvements.

Physical Security

Secure Your Key Drive

Treat your Necron Key Drive like a physical key to a safe:

• Don't leave it plugged into an unattended computer
• Remove the Key Drive when not actively using the app
• Store backups in a physically secure location

Secure Your Computer

• Lock your computer when stepping away
• Use strong account passwords
• Keep your operating system updated

Data Recovery Planning

Know Your Recovery Options

Test Your Backups

Periodically verify that your backup Key Drives work:

1. Connect a backup Key Drive
2. Open a vault
3. Decrypt a test file
4. Confirm the decrypted content is correct

Don't wait for an emergency to discover a backup is faulty.

Further Reading

• Security Overview — understand the threat model
• Free vs. Pro Tiers — tier differences
• Vault Health & Repair — how to verify vault health
• Backup Key Drives — creating and managing backups