Security at Areen
Areen is built on a single principle: nobody trusts anybody — not even us. Your encryption is in your hands alone.
Zero-knowledge architecture — Areen never sees your vault's contents, even if we wanted to
Security pillars
AES-256-GCM encryption
Everything in your vault is encrypted with the strongest symmetric standard. Even if one of our servers were breached, all it would hold is useless ciphertext.
AES-256-GCMArgon2id key derivation
Your password is never stored. We use Argon2id — the modern standard built to resist password cracking even on GPUs — with a random salt to derive the encryption key.
Argon2idShamir's Secret Sharing
Your vault key is split mathematically among your heirs. No single heir can open the vault — the configured quorum (2 of 3, for example) must act together.
SSS (k-of-n)Client-side encryption only
Encryption and decryption happen in your browser alone. Our server never touches the keys or the content — not even we can read your vault.
Client-sideECDH protocol for heirs
When the vault is opened, heirs exchange shares over Elliptic Curve Diffie-Hellman encryption. The server sees only ciphertext and never learns the key.
ECDH P-256Trusted infrastructure
The platform runs on Supabase (encrypted PostgreSQL) and Vercel (global CDN) with TLS 1.3 on every connection, plus automatic daily backups.
TLS 1.3How does the key flow?
The journey of your encryption key from creation to use
Your password
You type it into your browser
Argon2id + salt
An encryption key is derived from it — never sent to the server
Vault key
Encrypted with the derived key, then uploaded already encrypted
Shamir split
Divided into S1 (server) + S2 (heir) + S3 (paper)
Vault secured
The content is encrypted — the server sees nothing
Security questions people ask
What happens if one of your servers is breached?
Nothing that matters. The vault is encrypted with data that is only unwrapped on your device. An attacker would find ciphertext that means nothing without your key.
Can the Areen team look inside my vault?
No — it is simply impossible. The encryption key is derived from your password and never reaches our servers. That is a deliberate design decision.
What if I forget my password?
Choose “Forgot password” on the sign-in page and answer that you have the key. The link you receive gets you back into your account; your vault contents are opened by the recovery key issued when you created the vault. Paste it on the vault recovery page the link opens, and your vault is re-bound to your new password. On the premium plan one heir must also approve. We cannot open your vault without that key.
I forgot my password and lost my recovery key. Do I lose my account?
No. Choose “Forgot password” and answer that you do not have the key. The link you receive sets a new password and starts you on an empty vault; you keep your account and subscription. Your old vault is not deleted straight away — we keep it, still encrypted, for 90 days. If you find your key in that time, contact support and we will restore it for you to open with the key. After starting fresh, send your heirs their shares again from the heirs page.
Where should I keep my recovery key?
Print or write it down and keep it away from your device, with your important documents. We show it once and keep no copy. If you lose it while you still remember your password, issue a new one from the heirs page; the old key stops working immediately.
How do you prevent heirs from colluding?
The required quorum stops any single heir from opening the vault. On the free plan, for instance, two of three heirs must cooperate — and every step is written to the audit log.