Nothing to find.

Custodia moves files and folders into an AES-256 vault on your Mac. Finder, Spotlight and ls don't show them grayed out or marked private. Search for one by name and they return no result at all.

Coming to the Mac App Store How the encryption works

PHP 199, paid once. Universal Purchase. Buy once, use on Mac and iPhone.

$ mdfind -name "Tax 2025.pdf"
(no results)
$ cd ~/Library/Containers/com.zewify.custodia
$ grep -rl "Tax 2025" .
(no results)

Names never reach the disk. Finder, Spotlight and ls see numbered ciphertext, open or locked; locking makes Custodia forget the keys, so only your password opens it again.

Claims you can check rather than trust

Security software asks for an unusual amount of faith. These three are the ones you can verify without taking anyone's word for it.

No network entitlement: Custodia runs in the App Sandbox without the entitlement macOS requires to open a connection. Not "we promise not to" — the app has no route to the network to begin with.
No account, no telemetry: There is nothing to sign up for and nothing to opt out of. No identifier, no crash reporter, no analytics. The App Store privacy label reads Data Not Collected.
Apple's cryptography, not ours: AES-256 through CryptoKit on both platforms. No hand-rolled crypto, and no third-party packages anywhere in either app.

One vault format, two platforms

The Mac and the iPhone keep the vault the same way: every item encrypted on its own, under a key hierarchy that starts at your password. A backup made on one opens on the other.

macOS

macOS 13 Ventura or later

Files and folders, sealed item by item, inside the App Sandbox.

The vault lives in Custodia's sandbox container. On disk it is one file per item, named by a random ID; names, dates and origins exist only in an encrypted manifest.
A folder goes in whole — nesting, permissions, links — as one encrypted archive, streamed through the cipher so no unencrypted copy is ever written.
Opening an item decrypts a private copy for its usual app. Save as normal: when the vault locks, your edits are sealed back in under a fresh key and the copy is erased.
Right-click any file or folder in Finder and choose Lock with Custodia to move it in. It is a macOS Service, the one route by which Finder can hand a sandboxed app the items themselves — and nothing moves until you enter your password or confirm.
The vault is included in Time Machine. What it copies is ciphertext, and it is how a vault survives a dead disk.

iOS

in development

Per-item envelope encryption, so no single key is ever holding the whole library open.

Your password runs through PBKDF2-HMAC-SHA256, calibrated to about half a second on your device and never below 600,000 iterations.
That derives a key which wraps a random 256-bit vault key, which in turn wraps one separate key per photo, video and document. Deleting an item means dropping its key.
No password hash is stored anywhere. The authentication tag on the wrapped vault key is what proves the password was right.
Face ID is a convenience wrap of that key and not a way around it. Re-enroll a face or change the passcode and the wrap is invalidated — the app falls back to asking for the password.

What Custodia will not do

Every vault has edges. Knowing where they are is the difference between a tool you can rely on and one that surprises you at the worst moment.

A forgotten password ends it

There is no reset, no recovery key and no back door, because any of those would be a second way in. Lose the password and the contents are gone for good.

Auto-lock watches Custodia, not the item you opened

The idle timer tracks activity inside Custodia. Working in an opened item in another app does not reset it, so a long session there can still lock underneath you — edits you saved are kept when it does.

Secure delete is best effort

On an SSD, wear leveling can leave traces of overwritten data beyond the reach of any application. For anything genuinely sensitive, run FileVault on the source disk as well.

Apps stay out

Custodia runs in the App Sandbox, and macOS will not launch an app a sandboxed app has stored. An app that went in could never run again, so Custodia refuses apps — and folders holding them — and says why.

Bought once, not rented

The vault runs entirely on your device. There is no server to keep running, so there is nothing to charge you rent for.

Everything described on this page stays yours. Nothing you have already bought will move behind a subscription later.

PHP 199

one-time purchase

Outside the Philippines, the App Store shows it in your own currency.

Mac and iPhone on a single Universal Purchase
Every current and future local feature
No account, no subscription, no upsell

Coming to the Mac App Store