How We Protect
Your Documents

Because your password is the key, a normal "forgot password" reset can't work the way it does on other sites — resetting the password without your original one would permanently lock your own documents. Instead, at setup you're shown a 24-word recovery phrase once. It's a second, independent way to unlock the same key, and it's the only way back in if you forget your password. We never see it, and we cannot show it to you again — if it's lost along with your password, recovery requires manual verification with our support team.

When you generate a share link, the decryption key is appended to the URL after a # — a part of the address browsers never transmit to any server. The link itself, stored in our database, is useless without that fragment. Whoever holds the full link holds the key; we only ever hold the token.

Your password is never stored. When you create or change a password, IDVault runs it through bcryptwith a cost factor of 12. bcrypt deliberately takes ~250 ms to compute a single hash and generates a unique random salt for each user. An attacker who obtained a copy of the database would still need to compute billions of hashes — taking centuries — to recover your password.

After you log in, IDVault issues a JSON Web Token (JWT) signed with HMAC-SHA256. The token encodes your user ID and an expiration timestamp, and is cryptographically signed with a secret key only the server knows. Every API request presents this token; the server verifies its signature and expiry before responding to anything.

Your files are encrypted in your browser — with a key derived from your password — before they're ever uploaded. What reaches Amazon S3 is already unreadable ciphertext; S3's own Server-Side Encryption (SSE-S3) then wraps it a second time as an additional layer of defense-in-depth. The important part isn't where the file is stored — it's that the storage layer never has a key capable of opening it.

All communication between your browser and IDVault servers uses Transport Layer Security (TLS) — the same standard used by online banking. HTTP connections are rejected or redirected to HTTPS. The Content-Security-Policy header and strict CORS configuration prevent your credentials or documents from being intercepted by third-party scripts.

Every uploaded file is inspected at the binary level before it's accepted — in your browser, before encryption. IDVault reads the first bytes of the file — known as magic bytes — to confirm the file is actually what it claims to be. A renamed .exe disguised as a PDF is detected and rejected immediately, regardless of what the filename says. Because the server only ever receives ciphertext, this check has to happen on your device — it's the only place the real file bytes ever exist outside your own hands.

PDFs can embed executable JavaScript, automatic actions (OpenAction), and event handlers (AA) that execute code when a file is opened. Before your PDF is encrypted, IDVault parses it — client-side, on your device — and removes all of these active-content entries from the PDF catalog and Names dictionary. The sanitized file is then re-serialized with a clean object stream and only that version is ever encrypted and uploaded.

Share link tokens are generated using Node's crypto.randomBytes(32), producing 256 bits of cryptographically secure randomness. This makes tokens computationally impossible to guess or enumerate. Each token maps to exactly one document and one owner in the database.

Every share link carries a server-enforced expiry timestamp. After the deadline, the link returns HTTP 410 Gone — the document is no longer accessible. One-time links are burned on first access: the usedAt field is set atomically, preventing replay access. Links can also be revoked at any time before expiry.

When a shared document is opened, IDVault can apply diagonal watermarks across every page of the PDF, along with a short reference code unique to that share link. Because the server only ever holds ciphertext, watermarking now happens in the recipient's browser — right after their key decrypts the file, and before it's rendered — so the server never needs, or gets, a readable copy just to stamp it. Downloads can still be blocked entirely for sensitive documents.

Every sensitive action — document upload, deletion, share creation, password change, 2FA enable/disable, billing update, account export — is recorded in an immutable audit log with a UTC timestamp and full metadata. This trail is used for internal security monitoring and, if requested, can be included in your data export for your own records.

Every HTTP response from IDVault includes a hardened set of security headers enforced by Helmet.js and Next.js configuration: a Content-Security-Policy that blocks unauthorized scripts and iframes; X-Frame-Options: DENY to prevent clickjacking; X-Content-Type-Options: nosniff; and a Permissions-Policy that restricts microphone and geolocation access to none.

A global rate limiter caps all API traffic at 200 requests per minute per IP address. Authentication endpoints, upload routes, and other sensitive paths carry stricter per-route limits. Requests that exceed the limit receive HTTP 429 and must wait. This prevents brute-force login attacks, credential stuffing, and automated scraping.

IDVault's API uses a strict CORS allowlist — only requests originating from the official myidvault.io domain are accepted. No wildcard (*) origins are permitted. This prevents malicious websites from silently making authenticated requests to the API on behalf of logged-in users (cross-site request forgery via CORS).

You can export a complete copy of everything IDVault stores about you at any time from the Settings page. The export is a structured JSON file that includes your profile information, account metadata, share link history, and a complete activity log. Document files are stored separately in encrypted cloud storage and are noted in the export with their metadata.

Account registration requires email verification via a cryptographically random 256-bit token sent to your address, valid for 24 hours. Email address changes follow the same pattern — a confirmation link is sent to both the old and new address, and the change is only applied after the new address is confirmed. This prevents account takeover via email-change attacks.