Skip to main content
Get Started
Docs menu

Security & privacy

Security model

This page explains how Citadel protects your data, in enough detail for anyone who wants to check our work. The short version: your data is encrypted on your device, your master password never leaves it, and our servers only ever store encrypted data that only you can read.

Key security features

  • End-to-end encryption

    All encryption and decryption happens on your devices.

  • Zero knowledge

    We never learn your master password or your keys, so only you can read your data.

  • Your master password is never sent

    Sign-in uses the SRP protocol, so your master password never leaves your device.

  • Encrypted three times in transit

    Your already encrypted data is encrypted again with a session key, then sent over HTTPS.

  • Keys stay on your device

    On Apple devices, keys live in the Keychain and are never synced to iCloud.

Our principles

  • Privacy by design. We can't lose, misuse or hand over data we don't have, so we design Citadel to know as little as possible.
  • Trust the math. Your data is protected by cryptography, not by promises or company policy.
  • Openness. We explain how Citadel works so that others can examine our decisions.

From master password to keys

Your master password never leaves your device. Before it's used, spaces at the beginning and end are removed and the text is Unicode-normalized, so the same password produces the same keys on every device.

Citadel then runs it through PBKDF2-HMAC-SHA512 with 650,000 iterations twice, each time with its own random salt. This produces two independent keys:

  • Account key, which protects your other keys.
  • Authentication key, which is used only to sign in.

Because the salts are different, knowing the authentication key reveals nothing about the account key.

The key hierarchy

Your data is protected by a chain of keys, each encrypted by the one above it. Random keys are generated on your device using the system's secure random number generator (Apple CryptoKit on Apple devices).

  1. Master password

    Known only to you. Never stored and never sent anywhere.

  2. Account key

    Derived on your device with PBKDF2-HMAC-SHA512 and 650,000 iterations. Never stored or sent.

  3. Master unlock key

    A random 256-bit key, encrypted with your account key.

  4. Private key

    An RSA key pair generated on your device. The private key is encrypted with your master unlock key.

  5. Vault key

    A random 256-bit key, encrypted with your public key.

  6. Your items and attachments

    Encrypted with your vault key using AES-256-GCM.

Data is encrypted with AES-256-GCM. Every encryption uses a fresh random nonce, and GCM's built-in authentication means any tampering is detected when the data is decrypted.

Signing in with SRP

Citadel uses the Secure Remote Password (SRP) protocol, as described in RFC 5054. Instead of a password, our server stores a verifier computed from your authentication key. The verifier can't be used to sign in as you or to decrypt anything.

Every sign-in is a mutual proof: your device proves it knows the authentication key, and our server proves it's the real Citadel server. Neither side sends the key itself. The result is a fresh session key that protects the rest of the session.

Data in transit

When your data travels between your device and our servers, it's protected by three layers:

3HTTPS

The connection itself is protected with TLS.

2Session encryption

Every request and response is encrypted again with AES-256-GCM, using a session key agreed at sign-in.

1Your data

Already encrypted with your vault key before it leaves your device.

Network requests use ephemeral sessions, so no cookies or response caches are written to disk.

Data on your devices

Your vault data stored on your device is encrypted. On Apple devices, Citadel's keys are kept in the Keychain with these settings:

  • Available only while your device is unlocked.
  • This device only. Keys are never synced to iCloud Keychain and aren't restored to another device from a backup.

You can unlock Citadel with biometrics, such as Face ID or Touch ID. If the biometrics on a device change, Citadel asks for your master password. If your device is lost or stolen

What our servers store

End-to-end encrypted, readable only by you: everything in your vault, including your items, attachments and the keys that protect them.

Readable by Citadel, so we can sync your devices and manage your subscription:

  • Your email address, which serves as your account ID
  • Device names, and when each device last signed in
  • When items were created or changed, but never what they contain
  • Your App Store subscription status

This information is stored encrypted at rest, and none of it reveals what's inside your vault.

Reporting a security issue

If you believe you've found a security issue in Citadel, please contact us using the Support link at the bottom of this page.