Security

Clear security.
No theatre.

Security claims should be understandable, testable and limited to what the product actually does.

Local TOTP generation

OTP secrets are used on the device to generate current authentication codes. Kelyro does not need readable OTP secrets on the sync server.

Encrypted sync

When sync is enabled, vault data is encrypted locally using AES-256-GCM before it leaves the device. The service can handle encrypted ciphertext, random identifiers and limited synchronization metadata.

Important: Encryption reduces what the sync service can read. It does not make a compromised or unlocked device magically safe.

Kelyro ID and recovery

A Kelyro ID identifies an encrypted sync identity. It is not a password and should never be treated as authentication on its own. Recovery also requires one of the user’s Recovery Codes.

Encrypted backups

Kelyro backup files use the .kelyroid format so a user can keep an encrypted copy outside the live app. Backups should be stored somewhere the user trusts and controls.

Responsible disclosure

If you believe you found a security issue, please use the responsible disclosure page instead of publishing sensitive details first.