Security
Encrypted here.
Stored there.
Your password stays with you, encryption happens on your phone, and the encrypted vault lives on a card you can hold.
Model
Two things are needed. Neither is enough alone.
- 01
Something you hold
The card carries the encrypted vault. By itself, it gives away no readable information about what is inside.
- 02
Something you know
Your phone uses the password to create the key. When the vault locks, the key is discarded.
- 03
Somewhere you trust
Your phone encrypts and unlocks the vault locally. No connection or server is needed.
Data flow
What happens to your vault.
- 01
Encrypt locally
You create the vault on your phone. Your password creates the key that encrypts it before any data is written to a card.
- 02
Store ciphertext
Each card receives the encrypted vault, never the readable secrets. The card needs no account, battery or network.
- 03
Unlock locally
The app reads the encrypted vault from the card. Your password recreates the key and unlocks the vault on your phone.
- 04
Discard the key
When the vault locks, the key is discarded and the phone no longer keeps an unlocked copy.
Limits
What MI8OS cannot do.
- Recover a forgotten password
- There is no reset email, recovery code or support override. Without the vault password, the vault cannot be opened.
- Restore every lost copy
- If all cards holding a vault are lost or damaged, MI8OS has no cloud copy to restore. Keep the three cards in separate places.
- Make a weak password strong
- The vault password protects the encrypted data. Use a long, unique password that is not reused anywhere else.
- Prevent physical loss or damage
- Encryption protects what is stored on a card; it does not prevent a card from being lost, damaged or erased. Gen 2 card protection can help prevent unauthorized erasure.
Lost or found
What happens when something goes missing.
A lost card shows no name, number or clue about what it contains. The data on it remains encrypted.
Your vault stays on your cards. If you lose your phone, install MI8OS on another compatible phone, tap any card and enter the vault password to restore access.
If you forget the vault password, it cannot be reset or recovered. There is no recovery code, reset email or support override.
Practices
How the app behaves while a vault is open.
- Auto-lock
- The vault locks after a short idle period.
- Reveal
- A secret is shown briefly, then masked again automatically.
- Clipboard
- Copied values are cleared after a short delay.
- Biometrics
- You can use biometrics for convenience during a session. Your password remains the key.
- Network
- No connection is required. The app works in airplane mode.
No back door.
Not even for us.
MI8OS cannot recover a vault if its password is lost.
Keep your secrets
where you can hold them.
See how the three-card system keeps an encrypted copy with you, at home and somewhere safely apart.