Compliance & Security Statement

SHRD Vault is designed for privacy and data sovereignty from the ground up. While we do not currently claim formal certifications such as ISO 27001 or SOC 2, the system architecture adheres closely to the principles and requirements of major data protection regulations, including the European Union’s General Data Protection Regulation (GDPR).

Built-In GDPR Compliance by Design

• Data Minimization: We do not require personal information to use the service.
• Encryption of All Personal Data: All sensitive or identifying user data, including account access credentials and billing records (such as invoices), is fully encrypted before storage. No plaintext user data exists in our infrastructure.
• No Tracking or Telemetry: We do not track user activity, usage statistics, or metadata within the vault. There are no cookies or fingerprinting mechanisms beyond what is required for core session integrity.
• Right to Erasure: Users retain full control over their data. Deleting your .dat key file and clearing local IndexedDB storage permanently removes access, and all personal data, including server-held ciphertext, becomes cryptographically meaningless.

Zero-Knowledge Architecture

• SHRD Vault follows a strict zero-trust model: our servers never see, store, or derive access to decrypted user content.
• All cryptographic operations occur on the client device using modern, peer-reviewed algorithms.
• Shared documents are encrypted with ephemeral symmetric keys and do not rely on centralized key storage.

Compliance Documentation

Organizations with enhanced compliance requirements may request:

• A technical breakdown of our encryption model
• Data processing policies
• Hosting security overview (for dedicated or licensed environments)

We are also in active consultation to pursue independent cryptographic audits and formal compliance certifications appropriate for enterprise and governmental use.

SHRD Vault is not just compliant by policy, it's compliant by design. Even in the event of a total infrastructure breach, no usable user data can be extracted, traced, or decrypted. Privacy is enforced, not promised.