Every identity holds its own key.
Client-side AES-256 with per-user keys. Sequrely’s servers store ciphertext they cannot read.
device key made on the device · never leaves it
└─ user key unlocks the vault · passkey or biometric
└─ item keys AES-256 per item · re-wrapped to share
server ciphertext + metadata · no plaintext
Illustrative key hierarchy. Per-user keys and client-side AES-256 ship today. Per-device keypairs and envelope encryption for multi-device are in development, with an external security review planned before general availability.
Six things that are true by design.
Not policies that can be relaxed. Properties of how the system is built.
End-to-end privacy
Vault items are encrypted on the device with AES-256 and per-user keys before they leave it. Sequrely’s servers store ciphertext and metadata. There is no plaintext secret to breach.
No central honeypot
Every identity holds its own key. There is no master vault whose compromise exposes everyone, and no Sequrely employee who can read a customer secret.
Device-bound identity
Each device generates its own keypair; the private key never leaves it. A master device authorizes and revokes others with envelope-encrypted, per-device wrapped keys.
Bounded autonomy
The agent is designed to act inside a versioned policy envelope. High-risk actions are human-gated by default. Every decision is designed to leave a sealed record.
Regulatory readiness
Audit-ready evidence for SOC 2 and ISO 27001 controls. GDPR and HIPAA data residency supported by architecture: sensitive data localized and under your control.
Reviewed before shipped
A written protocol spec and threat model for every cryptographic change, and an external security review planned before multi-device and passkeys reach general availability.
Where the keys are, and where they are not.
Scroll sideways to read the diagram.
- Holds:
- ciphertext · metadata · policy · evidence
- Never holds:
- plaintext secrets · private keys
Illustrative and simplified. The sharing path ships today; the identity map, policy envelope and ledger are designs. The full diagram is in the architecture brief, available on request.
Where data lives.
Hosting
Amazon Web Services. Region and enterprise data-residency options on request.
Authentication
AWS Cognito for account identity; passkeys (WebAuthn), TOTP and SMS for sign-in; device-bound sessions.
Processors
Amazon Web Services and Google, as listed in the privacy policy. Vault contents are ciphertext to every processor.
If something goes wrong.
The same discipline the product asks of your estate, applied to Sequrely’s own.
-
Detect
Session-health and security telemetry is monitored; anomalies open an incident with a named owner.
-
Contain
Affected sessions end, credentials rotate, devices are revoked. Blast radius is bounded by per-user keys: there is no master key to lose.
-
Notify
Affected customers are informed without undue delay and within the timelines your agreement and applicable law, including GDPR, require.
-
Review
Root cause, blast radius and the evidence trail go into a written postmortem.
-
Publish
Affected customers receive the postmortem and the changes made. The same report feeds your own audit file.
Plainly: not yet certified.
Sequrely does not claim SOC 2 or ISO 27001 certification today. Controls are mapped so that the evidence exists when the audit comes. Certifications will be listed here with their scope and date as they are obtained.
Report a vulnerability
Found something? Email info@sequrely.com with "Security" in the subject line. Reports are acknowledged within two business days. Good-faith research is welcome.
Documents on request.
Shared on request, by a person.
Shared under NDA where required.
Nothing to breach at the center.
Bring your security questionnaire. Expect direct answers.