Changelog ·
Your users’ data, end-to-end encrypted
Since October 10 your files and variables are end-to-end encrypted. Now the same goes for the data of your users: Vaultix keeps it, delivers it and checks logins with it, but can’t read it.
Before
Files were sealed, but usernames, emails, license keys, HWIDs, IP addresses and ticket conversations were stored readable, like on most platforms. A database leak or a legal demand could expose your customers.
What’s new
Encrypt user data (per app)
- Usernames, emails, names, notes, license keys, HWIDs, IP addresses, support tickets and the audit log’s old and new values are sealed so only your team and your server can read them.
- New apps have it on from the start. Existing apps turn it on in App Settings; the existing data is sealed in the background and the card shows the progress.
- Passwords, license keys and HWIDs never reach Vaultix from new SDK builds, hosted pages and the widget: they send hashes. Logins still work exactly as before for your users.
- Your dashboard shows everything in plain text for you and your team, right after you sign in. Search, sorting, the support view and the audit log work as before.
One Vaultix account phrase
- 24 words that back up every encrypted app of your account, including apps you create later. No more one phrase per app.
- Owners with older apps get a short dialog to switch; old app phrases keep working as a backup.
- Show it again or check it any time in Settings, always after your password.
Password reset that keeps your apps open
- Forgot your password? With your account phrase every app opens again at once and your team keeps its access.
- Without it, type each app’s own phrase on the reset page, or restore an app later in App Settings.
- No email code needed on the reset page; your authenticator app is asked if you use one.
Integration key for your server
- Webhooks, the website API and API-key integrations send user data sealed to a new integration key (vxi_…). Your server opens it with a few lines of code (Python and Node in the docs).
- The key is separate from the SDK key, so a key inside your app can’t read your user list.
- “Send user names” per webhook, if a Discord channel should show names for background events.
Why it matters
- A leak of our database or backups exposes no names, emails, keys or IPs of your users.
- We can’t hand over what we can’t read. Less readable personal data at your processor means less to worry about for you as the controller.
- Your support team still sees who opened a ticket, their key and the whole Discord conversation, so helping users is as fast as before.
- Large apps stay fast: the users page now shows 50, 100 or 250 rows per page and decrypts the rest in the background.
Also in this update
- New: the SDK for Python and C#, and the C++ SDK as a ready-built library (DLL / .so). All of them run the C++ SDK itself, so logins, decryption and checks behave exactly the same and the methods have the same names. Windows x64 and Linux x64. The C++ SDK stays available as source.
- The C++ SDK can list the files and folders of a product (GetFileList, GetFolderList). Both used to return an empty list.
- Support tickets show the user’s name and key for every staff member who may see the ticket, also without access to the users page.
- The audit log shows the name (and key) of end users who opened a ticket or signed up.
What you need to do
Step by step
- Save your Vaultix account phrase when the dialog asks (Settings → Vaultix account phrase).
- Download the new SDK and ship a new build of your app. Older builds keep working.
- If your server uses webhooks, the website API or integrations: copy the integration key and add the decryption code from the docs.
- Turn on Encrypt user data for your existing apps in App Settings.
- When all your users have the new build, turn on Require new app builds.
End-to-end encryption · Vaultix account phrase · Integration key (vxi_)