Integration guides

End-to-end encryption

Your files, folders and variables are encrypted before they reach Vaultix. We store and deliver them, but we can’t read them, and nobody can swap them.

What it means for you

We can’t read your content

Only you, the team members you approve and your app hold the keys. A database leak, a stolen backup or a demand to hand over your files gets encrypted data only.

Nobody can swap a file

Every upload is signed by the person who made it. Your app checks the signature and refuses anything else, even if it came from our servers.

Your password is enough

You don’t type keys. Your Vaultix password unlocks everything on any device, and it never reaches us either.

Nothing changes for your customers

Downloads work as before. The C++ SDK decrypts in memory, so nothing extra lands on disk.

New apps are always end-to-end encrypted. Older apps turn it on in App Settings.

How a file travels

Three locks, each with a different job.

Your browser

Encrypts and signs every file, folder and variable before it leaves your computer.

Can read: Everything

Vaultix

Stores and forwards only encrypted data, locked once more with a server key.

Can read: Encrypted data, names and sizes

Your app

Gets a fresh one-time lock on every download and decrypts in memory with your SDK key.

Can read: What your customer downloads

Lock	Who holds the key	What it stops
1. End-to-end	You, your approved team, your app	Vaultix, leaks and legal demands reading or changing your content
2. At rest	Vaultix, kept outside the database and backups	A database dump plus a key pulled from your app being enough
3. Per download	Nobody: a new one-time key every time	Captured or replayed downloads, and downloads without a live, licensed session

Your keys

1
A recovery phrase, once
When you create an app, your browser makes a 24-word recovery phrase. It holds all of the app’s keys. Write it down; Vaultix never sees it and can’t restore it.
2
Your password, every day
Your browser keeps the app’s keys in a vault that only your password opens. That vault is stored with Vaultix, so you can sign in anywhere. We hold it, but we can’t open it: your password never leaves your browser.
3
The SDK key, in your app
App Settings shows a vxk_… key. Put it in your app with SetContentKey. It can open downloads, nothing else.

Keep the phrase safe

Your password is the everyday key. The phrase is the backup if you ever lose access to your account. Anyone with the phrase can open the app’s files.

Team members

Team members never get your phrase. Each one has their own key, opened with their own password. You decide who gets access to encrypted content.

1
They sign in
Their key is created at their first sign-in. Until you give access they see their key’s fingerprint, such as 5781-8166-D1C1-6717.
2
You compare and give access
App Settings → End-to-end encryption lists everyone waiting, with the same fingerprint. If it matches what they see, click Give access. Vaultix never gives access by itself, so a fake member can’t slip in.
3
When someone leaves
Their access ends right away. The next time you open the app, your browser quietly switches the team to a new key, so the old one stops working for anything new.

In your app

main.cppC++Copy

Vaultix::VaultixClient client("https://vaultix.cc/api");
client.SetApiKey("ap_your_app_key");
client.SetContentKey("vxk_your_sdk_key");   // App Settings → End-to-end encryption

if (client.AuthenticateWithKey(licenseKey)) {
    // Decrypted in memory; the signature and SHA-256 are checked first.
    std::vector<uint8_t> data = client.DownloadFileToMemory(productId, "game.dll");
}

Every download is encrypted again with a key that exists only for that one request.
The SDK checks that the file was signed by someone you approved, then its size and SHA-256.
IsValidFileHash compares a keyed hash, so Vaultix never learns your files’ checksums.
Older SDK builds can’t open end-to-end encrypted files. Update before you turn it on for an existing app.

What Vaultix still sees

Being honest about the limits matters as much as the encryption.

File names, sizes, which product they belong to, and who downloads what and when.
Someone with a valid license who takes apart the running app can read what the app decrypts. That is true of any delivery system.
The dashboard’s code comes from our servers, as with every web-based encryption product.
Members trust your app’s key the first time they see it. The fingerprint lets them compare it with yours.

Technical details

Part	How
Content	AES-256-GCM in 1 MiB chunks, a random key per file
App keys	X25519 and Ed25519, derived from the 24-word phrase (BIP39) with HKDF-SHA256
Your password	PBKDF2-SHA256 with 600,000 rounds in your browser; Vaultix gets only a derived login value
Signatures	Ed25519 by the uploader, approved by the app owner’s key
Checksums	HMAC-SHA256 with a key only your app and team have
Delivery	A new X25519 key exchange for every download

Turning it on can’t be undone. Existing files are re-encrypted in your browser, and the old copies are deleted afterwards. See Files and folders for uploading and downloading.

Vaultix · Features · Pricing · Documentation · Changelog · llms.txt