AES-256-GCM
Documents are encrypted locally using AES-256-GCM. This standard protects content confidentiality and helps detect unauthorised modification of encrypted data.
Official NIST reference for AES ↗
Security & privacy
Your document security, clearly explained
KnoXia is a personal vault for documents that should not circulate: identity documents, bank details, insurance certificates, private photos, administrative documents and confidential information.
1. KnoXia’s role
KnoXia helps you keep personal, official or confidential documents on your mobile device in a vault separate from the rest of your phone. Its purpose is not to collect your data: it is to make them unreadable without access to your vault.
2. Free mode: a local vault, no account required
In Free mode, the vault operates locally on your device. No user account is required, no document is sent to a server and KnoXia does not display advertising. Your encrypted data remain in the application’s local storage.
Important consequence: if you lose your PIN in Free mode, no one — not even KnoXia — can retrieve or decrypt your documents.
3. Your PIN is the vault key
When creating your vault, you choose an 8-to-16-character PIN. This code does more than display a lock screen: it contributes to generating the key that encrypts and decrypts your documents.
KnoXia uses PBKDF2 with 600,000 iterations. This derivation makes automated attempts to guess a PIN much more costly. The PIN remains your secret: it is not sent to KnoXia, Vercel or a third-party service.
4. Cryptographic protections
PBKDF2 · 600,000 iterations
PBKDF2 transforms your PIN into an encryption key by performing a large number of iterations. This step significantly slows brute-force attempts.
IETF RFC 8018 reference for PBKDF2 ↗TLS 1.3 for Premium
During Premium backup or synchronisation, transfers use TLS 1.3. Data are already encrypted before transmission: TLS adds transport protection.
IETF RFC 8446 reference for TLS 1.3 ↗5. Biometrics: an alternative to the PIN
Depending on your device’s capabilities, you can use your fingerprint or facial recognition as a convenient alternative to the PIN. The PIN is always available. KnoXia’s lock remains separate from your phone’s general lock: lending an unlocked phone does not automatically open the KnoXia vault.
6. Photos and document import
Photos taken directly from KnoXia are kept only in the application. When a document is imported from your mobile gallery or files, KnoXia creates an encrypted copy in the vault. The original outside the vault remains your responsibility: permanently delete it from the gallery if it must no longer remain accessible in plain form.
7. Premium mode: encrypted backup and synchronisation
Premium mode adds remote backup and synchronisation of encrypted content. Each Premium vault has a unique technical identifier. A Premium access key is generated and kept locally only; it allows the application to validate access to Premium features locally.
After this validation, the vault identifier can be used to retrieve or synchronise its encrypted content. Vercel Blob receives neither your PIN, your Premium access key nor readable documents. The Premium access key does not replace the PIN: the PIN remains necessary to decrypt the vault content.
8. Transparency about reviews
KnoXia’s Free component has undergone a security review assisted by Ito AI. This is not an independent certification. The Premium component, including remote backup and synchronisation, has not yet undergone a dedicated security audit. KnoXia makes this clear so every user can make an informed decision.
9. What KnoXia cannot guarantee
No application can eliminate every risk. KnoXia cannot protect a device with a compromised operating system, a PIN disclosed to a third party, or someone with full access to your phone and authentication methods. Protect your PIN, keep your device up to date and make sure an import has completed before deleting the original.
10. Our commitment
KnoXia follows a simple model: your documents, your device and your keys. We prefer to explain the protections in place and their limits clearly rather than promise absolute security.