Protection
How your collection is protected.
Written plainly, because the people who need this most are not security specialists. If anything here is unclear, ask us — a question about how your data is held is always a fair one.
A list of what you own is worth more than any one watch.
A complete inventory — makes, references, serial numbers, values, photographs, and the address it all sits at — is precisely the document you would least like to see circulating. Cloud collection apps assemble exactly that list, on a server you do not control, alongside everyone else’s. Watch Vault Archive is built so the application never puts that list anywhere but your own computer.
What it protects against
The laptop is gone. The collection is not exposed.
Your collection is encrypted on disk, every part of it sealed with the same key. Someone who takes the computer, pulls the drive and reads it directly gets unreadable data — not a locked document they can work on, but scrambled information with no lock to pick. Your watches, values, serial numbers, photographs and attached documents are all covered by it.
There is no vendor database to breach.
No vendor accounts, no servers, no cloud storage, no copy held by us. The category of headline where a company loses its customer records cannot apply here, because we do not hold any.
The application cannot send your collection anywhere.
The application itself makes no network requests. The window that holds your collection is blocked from making network connections, and the app's own code opens none. There is no analytics, no telemetry, no crash reporting, no update check and no price feed. The application behaves identically on a computer that has never been connected to the internet.
The application has no mechanism to send or fetch anything itself. A few items in Settings and the Mac Help menu hand one of eleven fixed addresses to your operating system: three reference-directory pages, the guide to adding a watch, the support and FAQ page, the support email address with one of two subject lines, this application's own website, the publisher's website, the page for this application's owners on the website of Watch Vault Tracker, the publisher's iPhone, iPad and Mac app, and the website of Watch Vault Insurance, coming in 2027. Your own browser or mail app then opens them. Nothing from your collection goes with them.
Your collection’s file is ciphertext in any backup.
If your computer backs up to an external drive or a cloud service, what gets copied is the encrypted file. Whoever holds that backup — Apple, Microsoft, a backup provider, or someone who steals the drive — cannot read it without your passphrase. The application’s own backups, saved by hand or automatically on a Mac, are encrypted the same way. Files you export or print are different: the full archive and the Tracker file can be locked with a password when you save them, but a spreadsheet or PDF cannot, and it is backed up like any other file.
We cannot produce your data for anyone.
Because your passphrase only wraps the key that encrypts your collection, and neither leaves your computer, there is no mechanism by which we could hand over your collection in response to a subpoena, an insurer, or a support request. Not a policy we could change — an absence of the thing itself.
How the encryption works
Standard, well-understood cryptography. Nothing invented in-house.
AES-256, in an authenticated mode.
The same standard used to protect classified government information and banking systems. Authenticated means tampering with the stored file causes it to fail to open, rather than quietly producing altered records.
It unlocks the key rather than encrypting your data directly.
A random key encrypts the collection; your passphrase unlocks that key, through a deliberately slow derivation that makes guessing expensive. One practical benefit: changing your passphrase takes milliseconds and re-encrypts nothing, so you can change it as often as you like. The key underneath stays the same, though: your old passphrase, together with a copy of the collection made before the change, can still read that copy and later ones. Delete earlier copies you no longer trust (Data → Earlier versions).
An independent second way in.
Shown during setup, to be written down by hand, and formatted so it can be transcribed from paper without ambiguity between characters that look alike. It opens the collection on its own. Neither secret can be worked out from the other.
Unlock with your fingerprint, on your Mac.
In the Mac App Store edition, on a Mac with Touch ID, you can choose to unlock with your fingerprint: Settings → Touch ID → “Use Touch ID to unlock”. Switching it on asks for your passphrase or recovery key first. Only a finger enrolled on that Mac opens it, never the Mac’s login password, and your fingerprint never reaches the application: macOS checks it and answers yes or no.
It unlocks and nothing more. Changing your passphrase, replacing the recovery key, deleting a watch, erasing and restoring still ask for your passphrase or recovery key. It works on that Mac only: no backup carries it to another computer. Every 14 days the application asks for your passphrase instead, so you do not forget it, and if a finger is added to or removed from the Mac, Touch ID switches off until you type your passphrase and switch it on again.
Locking discards the key.
The application opens locked, and locks again on an idle timer. A locked collection is not a screen drawn over readable data — the key is discarded from memory and there is nothing to read until you supply a valid secret.
There is no reset
No backdoor, no escrow, no security questions, no support line that can let you back in. If you lose both your passphrase and your recovery key, the collection cannot be opened by anyone, permanently. This is the unavoidable other side of a design where nobody but you holds the key — and it is why the recovery key is worth writing down the day you set up.
What it does not protect against
Stated in full. A security claim that only lists its strengths is telling you something about the people making it.
- Malware on your computer while the collection is unlocked. Once you have entered your passphrase, the records are readable to the application — and to anything that has taken over your computer. Encryption at rest protects a file at rest; it cannot protect a session in progress.
- Someone watching you type. A keylogger, a camera, or a person over your shoulder defeats any passphrase.
- A passphrase kept badly. Written on a note attached to the laptop, or stored in a file on the same computer, it protects nothing.
- Anything you print or export. The application can produce readable insurance schedules, estate registers and folios on request. To open one in your browser, it writes an unencrypted copy to its own temporary folder, which it empties when it quits or next starts, or when you erase the collection (in the Microsoft Store edition, also when you uninstall the app). Anything you save or print from there is yours to protect. The two watch files (.json) can be locked with a password when you export them; spreadsheets and printed documents cannot.
- Changing a passphrase does not lock out old copies. Changing your passphrase or replacing your recovery key stops the application accepting the old one. It does not re-encrypt the collection. Someone with the old passphrase or key and a copy made before the change can read that copy, and later ones too. Earlier versions on your computer can be deleted; copies elsewhere cannot be recalled.
- Someone guessing offline. Anyone holding your encrypted file can attempt passphrases against it without limit. The derivation is slow by design to make that expensive, but the protection ultimately rests on choosing a passphrase that is long enough. Length matters more than punctuation.
- Deletion is not shredding. Deleting the collection removes the file; it does not overwrite the underlying storage. On modern drives, genuine erasure is not reliably achievable, and we do not claim it.
- A compromised computer at setup time. The recovery key is displayed on screen during setup. If the computer is already compromised at that moment, it can be captured then.
Independent review — and how to reach us
Watch Vault Archive is proprietary software, and its internals are not published. It is built and published by Aveneg Technologies, LLC. Security questions, findings and requests for detail from insurers, advisors or your own technical counsel are genuinely welcome: support@watchvaultarchive.com. Third-party components used within the application are credited at open-source attributions.
Still have a question?
The full FAQ covers encryption, backups, the recovery key, and what to do if something looks wrong.