On this page

Security Overview

Necron Vault Manager is designed to protect your files so that only you (with your Key Drive or software key) can access them. This page explains what protections are in place and what the system defends against.

How Your Files Are Protected

Strong Encryption

All file content is encrypted using XChaCha20-Poly1305, a modern, industry-standard encryption algorithm. This provides two guarantees:

  • Confidentiality — your files are unreadable without the correct key
  • Tamper detection — any modification to an encrypted file is detected and rejected during decryption

Encrypted Filenames

When files are stored in a vault, the original filenames are also encrypted. Cloud providers and anyone who accesses the storage folder see only random-looking filenames — they cannot determine what your files are named or what they contain.

Hardware-Anchored Keys (Pro Tier)

For Pro tier users, your encryption key lives on a physical Key Drive — not on your computer, not on a server. This means:

  • Your key cannot be remotely stolen
  • If your computer is stolen, the attacker can't decrypt your files without the Key Drive
  • You can store the Key Drive in a safe when not in use

Software Key Protection (Free Tier)

For Free tier users, the software key is stored securely on your computer and tied to your user account. Copying it to another computer or user account makes it useless.

Warning

Software keys (Free tier) offer convenience but do not provide the same level of security as Key Drives. For sensitive data, a Pro tier Key Drive is strongly recommended.

We Never See Your Files or Keys

  • Cloud providers only store encrypted data with random filenames — they never have your keys
  • Necron's servers handle account and subscription management only — they never see your keys or files
  • Only your Key Drive (or software key) can decrypt your data

What Necron Protects Against

Threat How You're Protected
Someone reads your files on the cloud All content is encrypted — cloud providers see only encrypted data
Your computer is stolen Files are useless without the Key Drive
Files are tampered with Encryption detects any modification
Someone analyzes your filenames Vault filenames are encrypted
Cloud sync errors corrupt files Health check detects corruption; self-healing repairs from other locations

What Necron Does NOT Protect Against

No security system is perfect. These are the known limitations:

Threat Why It's Not Covered
Someone has your Key Drive AND your TOTP device Physical possession of the Key Drive and authenticator grants access
Malware on your computer while the app is running Active malware could potentially read data from the running application
You lose all copies of your Key Drive Without the key, encrypted data is permanently inaccessible — there is no recovery

Multiple Layers of Protection

Your data is protected by several layers working together:

  • Your key on a removable USB device — not stored on your computer
  • Every file is encrypted and tamper-protected — modifications are detected
  • Filenames are hidden — metadata doesn't leak through filenames
  • Multiple storage locations — self-healing repairs damage from any single location
  • Optional vault TOTP — add an authenticator code for extra protection

For security vulnerability reports, please email security@necronsolutions.com.

Further Reading