How We Protect Your Vault
At Nodexi, we believe your personal documents—tax letters, contracts, bank statements, and ID documents—belong to you and only you. That is why we designed a **Zero-Knowledge at Rest** security architecture. Even in the event of an infrastructure breach, your data remains completely encrypted and unreadable by anyone else.
1. Zero-Knowledge Encryption
Zero-Knowledge means that Nodexi hosts your vault, but holds absolutely no keys to unlock it. All files, AI transcriptions, and search indexes are encrypted on your device before they are sent to our cloud.
Device-Level Master Key
A cryptographically secure key is generated directly on your device. This Master Key is used to encrypt all of your documents, ensuring they cannot be read in transit or at rest.
Password-Derived Protection
Your password is used locally on your device to protect your Master Key. We never transmit your password or plaintext keys to our servers.
2. Split-Secret Key Recovery
Standard zero-knowledge apps have a major flaw: if you forget your password, your data is gone forever. Nodexi solves this through a secure **Split-Secret Key Recovery** system that balances user convenience with maximum security.
Isolated Key Separation
When you set up your account, the vault system creates independent cryptographic key parts:
- Secure Shards: The key fragments are stored in separate, isolated cloud environments.
- No Single Point of Failure: A single cloud environment breach does not compromise your data, as no individual key part can decrypt your Master Key.
How Recovery Works
If you lose your password, you can securely recover your vault using a multi-factor verification flow:
- Factor 1 (Email): You perform an authenticated email password reset to verify your account ownership.
- Factor 2 (Secure OTP): A one-time verification code is sent to your registered mobile phone.
- Reconstruction: Once both independent factors are successfully verified, the client app temporarily combines the secure key parts in-memory to decrypt and restore your vault access.
3. Emergency Break-Glass Procedure
In extreme cases—such as if a user passes away or completely loses access to both their password and recovery factors—we have a strict, audited **Break-Glass Emergency Procedure** to recover data for authorized relatives.
Multi-Administrator Approval
To prevent any unauthorized access or abuse, emergency recovery requires verified legal documentation submitted to support. The request must be independently signed off by two separate authorized system administrators. Only with dual authorization will the system release the isolated key parts to allow retrieval for the verified beneficiaries.