Every identity holds its own key.
Client-side AES-256 with per-user keys. Sequrely’s servers store ciphertext they cannot read.
device key made on the device · never leaves it
└─ user key unlocks the vault · passkey or biometric
└─ item keys AES-256 per item · re-wrapped to share
server ciphertext + metadata · no plaintext
Per-user and per-device keys with client-side AES-256; multi-device uses envelope encryption with per-device wrapped keys.
Six things that are true by design.
Not policies that can be relaxed. Properties of how the system is built.
End-to-end privacy
Vault items are encrypted on the device with AES-256 and per-user keys before they leave it. Sequrely’s servers store ciphertext and metadata. There is no plaintext secret to breach.
No central honeypot
Every identity holds its own key. There is no master vault whose compromise exposes everyone, and no Sequrely employee who can read a customer secret.
Device-bound identity
Each device generates its own keypair; the private key never leaves it. A master device authorizes and revokes others with envelope-encrypted, per-device wrapped keys.
Bounded autonomy
The agent acts inside a versioned policy envelope. High-risk actions are human-gated by default, and the agent never executes them. Every decision leaves a sealed record.
Regulatory readiness
Audit-ready evidence for SOC 2 and ISO 27001 controls. GDPR and HIPAA data residency supported by architecture: sensitive data localized and under your control.
Reviewed before release
A written protocol spec and threat model for every cryptographic change, and an external security review before each major release.
Where the keys are, and where they are not.
Scroll sideways to read the diagram.
- Holds:
- ciphertext · metadata · policy · evidence
- Never holds:
- plaintext secrets · private keys
Simplified. The full diagram is in the architecture brief, available on request.
Where data lives.
Hosting
Amazon Web Services. Region and enterprise data-residency options on request.
Authentication
AWS Cognito for account identity; passkeys (WebAuthn), TOTP and SMS for sign-in; device-bound sessions.
Processors
Amazon Web Services and Google, as listed in the privacy policy. Vault contents are ciphertext to every processor.
Evidence, exported.
Every enforcement decision lands in a hash-chained ledger. Auditors get the chain, the control mapping and the proofs.
If something goes wrong.
The same discipline the product asks of your estate, applied to Sequrely’s own.
-
Detect
Session-health and security telemetry is monitored; anomalies open an incident with a named owner.
-
Contain
Affected sessions end, credentials rotate, devices are revoked. Blast radius is bounded by per-user keys: there is no master key to lose.
-
Notify
Affected customers are informed without undue delay and within the timelines your agreement and applicable law, including GDPR, require.
-
Review
Root cause, blast radius and the evidence trail go into a written postmortem.
-
Publish
Affected customers receive the postmortem and the changes made. The same report feeds your own audit file.
SOC 2 and ISO 27001: pending.
Controls are mapped to both frameworks and evidence is collected continuously from the sealed ledger, so audit requests are answered from the record. Each certification is listed here with its scope and date on completion.
Report a vulnerability
Found something? Email info@sequrely.com with "Security" in the subject line. Reports are acknowledged within two business days. Good-faith testing is welcome.
Documents on request.
Shared on request, by a person.
Shared under NDA where required.
Nothing to breach at the center.
Bring your security questionnaire. Expect direct answers.