Lastkey encrypts vault content on your device before upload. Our servers store ciphertext only, and vault keys are split so no single system can decrypt your data by itself.
Vault items are encrypted locally. Lastkey stores ciphertext only and cannot read your notes or files.
The vault master key is split using 2-of-3 Shamir secret sharing so no single share can unlock a vault.
Unlock uses your Vault PIN or an optional passkey. Passkeys rely on WebAuthn user verification and never share biometrics with Lastkey.
We collect the minimum required for vault operations. Beneficiary emails are used for invites and replaced with account IDs when possible.
Encryption and key handling are designed to keep secrets on user devices and to reduce single points of compromise.
Invite links use a URL fragment key that never reaches our servers. Releases require explicit user action and authenticated access.
The decryption key lives after the # in the URL, so it is never sent to Lastkey or logged by the server.
Invites are designed to be one-time, expiring, and revocable to limit exposure if an email is compromised.
Claiming requires deliberate user action to protect against automated email scanners.
Security is about tradeoffs. These are the primary protections we provide and the scenarios where you still need to stay vigilant.
We combine crypto with practical product safeguards to limit accidental exposure.
URL fragments, key shares, and decrypted content are never logged or sent to analytics.
Vault sessions auto-lock after inactivity, with manual lock controls for shared devices.
After decrypting invites, the URL fragment is cleared to prevent key leakage through history.
If we suspect a security issue, we disable affected endpoints, preserve evidence without collecting secrets, patch the issue with regression tests, and notify stakeholders when required.