Security
How EdgeVault protects what you write down, where your key lives, and what EdgeVault's servers can and cannot read.
Updated 30 October 2026
What is encrypted
Your own content
Your sensitive content, such as your rules, journal entries and tilt events, is encrypted in your browser before it reaches EdgeVault. EdgeVault's servers store the encrypted result and cannot read it. Section 6 of the Privacy Policy lists all of it.
Without an account
If you use EdgeVault without signing in, what you enter stays in your own browser and is not sent to EdgeVault's servers.
How the key is made
From your passphrase
You set a passphrase when you create your account, and your browser turns it into a key using a standard key derivation method that is deliberately slow.
How each record is locked
Each record is encrypted with strong encryption built into your browser, which also shows whether the record has been changed.
Technical detail
Technical detail is available on request from support@edgevault.ai.
Where the key lives
On your device only
The key is made in your browser and is not sent to EdgeVault. It stays in your browser for the unlock period you choose and is cleared when you lock or sign out.
An optional PIN
A PIN gives quick unlocks on your own device. After repeated wrong PINs the full passphrase is needed again.
What EdgeVault's servers hold
For your encryption
EdgeVault's servers hold only what your browser needs to unlock and recover your data. Never your passphrase, your key or your recovery code.
Readable by design
Data a feature must read on the server is not end-to-end encrypted, such as your account and billing details, settings, rule check results and streaks, and server price alerts. Section 6 of the Privacy Policy lists all of it.
Trading keys
EdgeVault never holds private keys or seed phrases and does not hold your funds. A venue API key you link is stored encrypted and used only for orders you place.
AI and your data
When AI processing is on
Some features then send your question, and the data needed to answer it, to an AI service provider. Anything encrypted that the answer needs is decrypted in your browser and sent for that request. AI service providers use your request only to answer it and do not train on it. You can switch AI processing off in Profile, and the Privacy Policy has the detail.
If you lose your passphrase
Your recovery code
It is shown once at setup and is the only way back in. Without the passphrase and the recovery code your encrypted data cannot be recovered by you or by EdgeVault, and the passphrase cannot be changed at the moment.
Reporting a problem
Found a weakness
Email support@edgevault.ai with what you saw and how to repeat it. More on accounts and recovery is in Account and security.