Trust

What our trust claims actually mean

Four principles guide how DynoLocker - Credential Manager is built. Here's what each one is, exactly how the app uses it, and what it guarantees for you.

Zero-knowledge architecture

Zero-knowledge

Zero-knowledge means the service that stores your data has no knowledge of what that data actually is. Bizhub holds your encrypted blobs, but never the keys needed to make sense of them.

How we use it

  • Encryption keys are derived in your browser from a 12-word recovery phrase that never reaches our servers.
  • We persist only a bcrypt hash of that phrase to verify you — never the phrase itself.
  • Every secret, file and folder name is stored as an opaque encrypted blob alongside its salt and IV.
  • Account recovery cannot reveal your data: with no keys on file, even our own team can't decrypt it.

What this means for you: A breach of our infrastructure exposes unreadable ciphertext, not your secrets — and no insider, subpoena or mistake can hand over what we don't have.

AES-256-GCM encryption

AES-256-GCM

AES-256-GCM is an authenticated encryption standard. The 256-bit key makes brute force infeasible, and GCM mode adds an integrity tag so any tampering is detected, not silently accepted.

How we use it

  • Each item is encrypted with a 256-bit key and a fresh random 12-byte IV, so identical passwords never produce identical ciphertext.
  • The GCM authentication tag is verified on every decrypt — altered or corrupted data is rejected outright.
  • The same cipher protects passwords, secrets and uploaded files, using the Web Crypto API in your browser.
  • Keys are imported as non-extractable AES-GCM keys, so the running app can use them but can't export them in the clear.

What this means for you: Your stored data is both private and tamper-evident: nobody can read it without your key, and nobody can quietly change it without detection.

Client-side encryption

Client-side

Client-side (end-to-end) encryption means the encrypt and decrypt steps happen on your machine, not ours. By the time data reaches the network, it is already ciphertext.

How we use it

  • Encryption and decryption run entirely in your browser via the Web Crypto API.
  • Files are encrypted client-side before upload, with file-type allow-listing and size limits enforced locally.
  • Even in your browser's local storage, the data-encryption key is wrapped by a separate storage key — never cached in plaintext.
  • The app refuses to run outside a secure HTTPS context, so encryption can't be silently downgraded.

What this means for you: Your secrets are protected in transit, at rest on our servers, and even on your own device — we only ever handle data you've already locked.

Full audit trail

Audit trail

An audit trail is a chronological, per-entity record of who did what and when. It turns access into accountability across your whole team.

How we use it

  • Create, read, copy, view, move, login and logout events are logged at the item level.
  • Each entry is attributed to a user, so shared folders stay accountable.
  • Change logs and versioning let you trace how an item evolved over time.
  • Active sessions are visible and revocable, so you can cut off access the moment something looks wrong.

What this means for you: You always know who touched a credential and when — making misuse easy to spot and quick to shut down.

See the full security model

Start protecting your credentials today

Set up your encrypted vault in minutes. Your data is encrypted on your device before it ever reaches us — that's a promise backed by math, not policy.

Get started Read the security model