AliasVault

Security

How we protect your data, from end-to-end encryption to where our servers physically run.

End-to-end encryption

AliasVault is built as a zero-knowledge system: your vault is encrypted and decrypted locally on your own device, and your master password never leaves it. Our servers only ever store an encrypted vault that is useless without your keys.

  • Your encryption key is derived from your master password on your device using Argon2id, and your vault is encrypted with AES-256-GCM.
  • Emails received on your aliases are encrypted with your public key before they are stored, so only you can read them.
  • Neither our team nor anyone else with access to our servers can read the contents of your vault, we simply do not have the keys.

Want the full technical picture? Read our architecture documentation.

Cloud infrastructure

The AliasVault cloud service runs exclusively on dedicated servers under our own control, located in the European Union and spread across independent providers and countries to separate concerns and avoid single points of failure.

  • Main infrastructure: Germany, on dedicated servers hosted by Hetzner.
  • Backup infrastructure: Finland, with real-time replication from the main location to cover geographical outages.
  • Website & documentation: The Netherlands, hosted by Leaseweb.
  • Status page: France, hosted separately with OVHcloud. It monitors all AliasVault infrastructure 24/7 and is where we communicate outages and planned maintenance: status.aliasvault.com

All user data is stored within the EU and we are fully compliant with European GDPR regulations.

Backups & continuity

AliasVault utilizes a hardened backup strategy ensuring your data is safeguarded:

  • Backups run multiple times per day.
  • All backups are fully encrypted, both on-site and off-site.
  • Backups are stored off-site, in a different location than the primary servers, alongside offline cold-storage copies as a last line of defense.
  • Real-time replication between Germany and Finland keeps a live copy of the service ready in a second geography.

You can follow the health of all our systems in real time on our status page.