Security — Custodia by Zewify

What Custodia is for

Custodia protects data at rest on a device you physically hold. Someone with your locked Mac or iPhone — a thief, a repair shop, a border officer, a housemate — cannot read a locked vault without the master password.

It is not a defense against a compromised device. Malware already running as you, a keylogger, or someone watching an unlocked screen can see whatever you can see. No vault can fix that, and one that claimed to would be lying.

One format on both platforms

The Mac and the iPhone keep the vault the same way: each item encrypted separately with CryptoKit, under a key hierarchy rather than a single volume key. A backup made on one restores on the other.

Your password goes through PBKDF2-HMAC-SHA256 against a 32-byte random salt. The iteration count is calibrated on first run to take roughly half a second on your particular device, and never drops below 600,000.
The derived key wraps a vault master key: 256 bits of randomness that never leaves memory unwrapped. The password protects this key and nothing else.
The vault master key wraps the manifest key and one random file key per item. Because no bulk data is ever encrypted under the master key directly, deleting an item is simply dropping its key. The manifest — every name, date and origin — is itself encrypted, so the files on disk are named by random IDs and say nothing about what they hold.
Item bytes are encrypted as 1 MiB AES-256-GCM chunks. Each chunk's nonce combines eight random per-item bytes with the chunk's position, and each chunk is authenticated against the item's identity, its index, and whether it is the last one.

That last detail is what stops a tampered file from being quietly accepted. Reordering chunks, substituting a chunk from another item, truncating the final chunk, or flipping a single bit all fail loudly — and the test suite asserts each of those failures individually, so they cannot regress unnoticed.

No password is stored, not even hashed

Nothing on the device records your password or a hash of it. The authentication tag on the wrapped vault master key is the verifier: the wrong password fails to unwrap, and that failure is the entire check.

macOS: inside the App Sandbox

Custodia runs in the App Sandbox with one capability beyond it: access to files you pick, drop on its window, or send from Finder. It cannot reach anything else on the Mac, and it has no network entitlement.
The vault lives in Custodia's own container, under ~/Library/Containers/com.zewify.custodia/.
A folder is stored as one Apple Archive, streamed through the chunked cipher as it is written and as it is read, so no unencrypted archive ever exists on disk.
Opening an item decrypts a private copy into the container's temporary folder for its usual app. When the vault locks, an edited copy is encrypted back in under a fresh key and nonce — never reusing the old ones — and every copy is erased, even if saving an edit fails. Quitting locks, and launch clears anything a crash left behind.
Restore and Move Out decrypt to a place you confirm in a save panel, and never overwrite what is already there.
The vault is included in Time Machine. What Time Machine copies is ciphertext, and a backup is how a vault survives a dead disk.

iOS: Face ID and sharing

Face ID is a shortcut, not a second door

Enabling Face ID stores one item in the Keychain — a wrap of the vault master key, marked so it never syncs to iCloud and is invalidated the moment a face is re-enrolled or the passcode changes. When that happens Custodia discards it and asks for the password again. It is the only thing the app ever puts in the Keychain.

Sharing into a locked vault

The share extension can accept a file while the vault is locked, which means it must encrypt something it cannot read back. It seals each new file key to the vault's public key and leaves the ciphertext waiting; the app absorbs it on the next unlock. The extension never holds the vault master key, so compromising it yields nothing that is already in the vault.

Rules the app holds to

No recovery path. Not a reset, not an escrowed key, not a support process that can let you back in. Every one of those is also a way in for someone else.
No network, on either platform. Neither app requests a network entitlement, so the capability is absent rather than merely unused.
No custom cryptography and no third-party packages. Apple's primitives only, and nothing else in the dependency list to audit or to trust.
No decoy vaults or fake crashes. Custodia can wear a plain window title and a neutral icon so it doesn't announce itself on a shared screen. It will not pretend to be broken or show a fake vault full of decoy files — under real duress those tricks tend to make things worse, not better.
Plaintext only where you put it. Decrypted copies of opened items live in the app's private scratch space — on macOS wiped on lock, on quit and on launch; on iOS also on backgrounding — and anything else decrypted goes only to a place you chose.

Where the edges are

These are the limits worth knowing before you rely on it, not after.

Secure deletion is best effort. SSD wear leveling can leave remnants of overwritten data that no application can reach. Run FileVault on the source disk if that matters to you.
Apps cannot go in on a Mac. macOS will not launch an app that a sandboxed app has stored, so an app that went in could never run again; Custodia refuses them.
An opened item is plaintext while it is open. Custodia's copy sits in its private container until the vault locks. The app you open it in may keep its own earlier versions in macOS's version store, which Custodia cannot reach; for anything highly sensitive, open it in an app that keeps no versions.
Auto-lock measures activity in the app. Working in an opened item in another app does not reset the idle timer.
Old snapshots remember. A Time Machine snapshot taken before you deleted an item still holds it — encrypted, and openable only with the password that was current then.
A backup is a second copy. It carries the same encryption and the same no-recovery rule, but it lives wherever you put it. Choose that place deliberately.

Reporting a vulnerability

Email support@zewify.com with what you found and how to reproduce it. Please give it a reasonable window before publishing, and expect a reply rather than silence.