Only you can open your vault.

Each person’s vault is its own container. There is no shared database with a column for whose document is whose, and no shared permission surface for one role to span vaults through. A separate encryption key sits on top of that, one per person.

Identity, health and pay documents are each encrypted with their own key, and only your face or fingerprint releases it. Vaile reads each one once, when it arrives, to note the details it needs, such as an expiry date, and it stays locked from then on.

Super statements and insurance policy schedules carry medical and personal detail Vaile has no use for, so the figures are noted and the file is not stored.

There is no standing connection between our people and a vault, so there is nothing sitting open to be taken. A request creates a package containing only what that request needs, granted to one named person, expiring, and written to the log you can read.

You sign in with your own identity, never a password we keep. Vaile provisions and maintains the recovery structure and never sees the secret. Where you nominate backup holders, no single holder can unlock alone, and that includes us.

Billing re-points to your account and ownership transfers, while the storage stays exactly where it is. A design that kept everyone in one shared store could not do this: handing someone their data would be a migration, with a copy made and an original left behind.

Every document you have given us and every version of it, in the form it arrived, with the metadata it came with and a readable index so it opens cold without us. What Vaile has worked out on top of those documents is our own work, and it is not part of the export.

The vault is a live system, so a frozen snapshot is written on a schedule into the storage you already own. The instructions for taking the container over sit beside it and are emailed to you as well, so the proof of independence does not depend on us being reachable.