GOOD TO KNOW.
GOOD TO UNDERSTAND.

Is my vault safe when it is synchronised online?

KORVAS is designed to encrypt vault data on your device before it is uploaded for synchronisation. The server stores the encrypted vault data, rather than a readable list of your passwords. Unlocking the vault requires the appropriate vault credentials and key material controlled by you.

KORVAS uses AES-GCM authenticated encryption and Argon2id-based key derivation in its vault technology. This is intended to make an obtained copy of an encrypted vault very different from obtaining the passwords inside it.

Why keep my main vault on my own device?

Your local vault remains under your control and can be available on your device without relying on a cloud connection. Synchronisation is an additional way to transfer encrypted vault data between your registered devices; it does not mean your only copy has to live online.

Keeping a local copy also means you can manage your own backups. As with any important data, we recommend keeping a separate backup in a safe place.

Can KORVAS see or recover my vault password?

KORVAS is designed around user-controlled vault credentials and key derivation. Your master password should never be shared with anyone, including KORVAS support. If you lose the credentials needed to unlock a vault, recovery may not be possible. Keep your password safe and maintain a secure backup.

Can I take a copy of my vault and store it somewhere else?

Yes. KORVAS supports exporting a vault file so you can keep a separate backup, for example on an external drive or other secure storage. Keep the exported vault protected and remember that anyone who obtains the file will still need the appropriate credentials to unlock it.

A backup is useful protection against device loss or damage. Store it somewhere separate from your everyday device and make sure you remember the vault password.

How long does KORVAS keep an encrypted synced vault on its servers?

During the beta, server-side encrypted vault copies are managed as temporary synchronisation data and may be removed as part of the beta retention and maintenance process. The precise retention period and deletion behaviour are still being confirmed, so beta users should not treat the server as their only backup.

We are considering giving users more direct control over this in the future, including shorter retention periods or the ability to remove a server copy themselves. Any available retention choices will be explained clearly before they are introduced.

Will I be able to choose how long my synced vault stays online?

That is an option we're considering. For example, users might be able to choose a short period or a longer period, or delete their server copy when they no longer need it. These controls are not currently being offered as account settings, so we won't advertise them as available until they're built and tested.

Will KORVAS Free really stay free?

Our planned general-release Free plan is intended to include one personal vault, up to two registered devices and encrypted synchronisation. We want essential password management to be accessible without a subscription. The public general release has not started yet; current access is through the beta programme.

What will Premium include?

Premium is planned as an annual subscription, presented with a monthly-equivalent price. It is intended to add capabilities beyond the Free plan, with eligible Premium upgrades included while the subscription is active. Final pricing, allowances and features will be confirmed before purchases open. Premium is not available to buy yet.

Is the Android app available?

The Android app can connect to a KORVAS account and synchronise supported encrypted vaults. It is currently being beta tested and refined, and is not yet a general public release. Windows and mobile beta capabilities may change as testing continues.