Security
Security across the BlackVault family
A plain summary. Each product stays responsible for its own security, privacy and data, and these are the statements its own site makes.
Security principles
BlackVault Group is the family's home and does not hold any product's private data. Each product keeps its own authorization, data and encryption.
Citadel
Citadel is the standard-tier security engine used by BlackVault Mail, BlackVault Drive and CM Chat. It is the "Protected by Citadel" you see on those products. It does not replace checking a product's own security.
Encryption and key management
What each product states about encryption. Detailed key-management documentation has not been published here yet.
- BlackVault Mail: Your messages are encrypted at rest, your outgoing mail is authenticated, and your data is never mined.
- BlackVault Drive: Encrypted in transit and at rest.
- CM Chat: Passkeys, encryption in transit and at rest, and a detailed log of admin activity.
- CM Chat: Files are encrypted before storage.
- BlackVault Authenticator: The company never receives or can read the encrypted backup.
Identity and device security
What each product states about sign-in.
- BlackVault Mail: sign-in hardened by passkeys and authenticator codes.
- BlackVault Drive: two-factor sign-in with an authenticator app and one-time recovery codes.
- CM Chat: passkeys.
- BlackVault Authenticator: fingerprint, face or PIN lock, with codes stored encrypted on the phone.
Infrastructure and operations
Coming soon Infrastructure and operations details have not been published yet.
Vulnerability disclosure
The BlackVault Group security disclosure policy is a draft. Until it is published, see the draft policy page.
Security advisories
Coming soon Advisories will be listed here when there are any to publish.
BSA independent assurance
BSA is the family's independent audit platform. It is not live, and no audit results are published here. This site makes no claim of certification or independent audit.