Last updated 7 September 2026
This page is for anyone who wants to know exactly how Ko | Do · Vault protects their data — and for business customers carrying out vendor due diligence. Everything here is taken from the documentation we actually operate by. If you need more, the bottom of the page says what we can provide.
We cannot read the contents of your vault. It is encrypted on your device before it is sent to us, and the key exists only with you. That is not a promise; it is the architecture.
Everything happens in your browser. Encryption and decryption run locally on your device. The server receives and stores encrypted data only.
The key is derived from your master password. The master password never leaves your device. The encryption key is derived from it using PBKDF2-SHA256 (600,000 iterations). Content is encrypted with AES-256-GCM.
We hold no copy and no backdoor. There is no “forgot password” function, no recovery and no support that can unlock your vault. If you forget your master password, the data is lost. This is a deliberate choice: it is the precondition for nobody else — including us — being able to read your data.
Passkey (Touch ID / Face ID) is local too. If you enable a passkey, an encrypted copy of your master password is stored in your browser’s local storage, encrypted with a key that only your passkey can derive. We use the WebAuthn PRF extension, which yields a secret bound to your device’s secure hardware (Secure Enclave / TPM). The key is never stored anywhere and is re-derived on every unlock. No passkey is registered on our server, and no biometric data ever leaves your device. If your browser does not support PRF, we do not offer passkeys at all — we do not fall back to a weaker method.
We may upgrade these methods over time. Such changes will never weaken the security of the service.
| We cannot see | We can see |
|---|---|
| Passwords, cards, ID documents and notes in your vault | First name, last name, email address, chosen subdomain, language preference |
| Your master password | That something happened: timestamps of logins, failed attempts and vault changes — never what |
| Your passkey key | IP address in technical logs, briefly |
| Stripe customer ID and invoice history — never card numbers |
The full picture is in the privacy policy.
We use five data processors. All are US companies, and we say so plainly rather than writing “everything is in the EU”.
| Provider | Role | Where data is processed | Transfer mechanism |
|---|---|---|---|
| Upstash, Inc. | Database | Frankfurt, with a read replica in Dublin | SCCs + DPF-certified |
| Vercel, Inc. | Hosting and operations | Frankfurt and Stockholm; logs may be stored in the US | SCCs + DPF-certified |
| Stripe (Stripe Payments Europe, Ltd.) | Payments and invoicing | Ireland and the US | SCCs + DPF-certified |
| Resend, Inc. | Transactional email | Sent from Ireland; metadata and logs in the US | SCCs + DPF-certified |
| Cloudflare, Inc. | Bot protection at sign-up | Global edge network | SCCs + DPF-certified |
Vault contents are encrypted on your device and unreadable to all of them. What they can process is metadata: name, email address, IP address and payment details.
What protects you is not jurisdiction but mathematics: vault contents are encrypted before they leave your device.
Metadata processed by the providers above may be processed in the US. Transfers rely on the EU Standard Contractual Clauses (SCCs). All five providers are additionally certified under the EU–US Data Privacy Framework, but the SCCs are our primary basis — certifications can lapse, and we do not rely on them alone.
We have carried out a Transfer Impact Assessment (TIA) in line with EDPB Recommendations 01/2020. It is reviewed annually, and legal developments in the EU and US are checked every quarter. Business customers can request the TIA.
| Data | Retained |
|---|---|
| Account and vault | Until you delete the account, or 28 days after the vault is locked (expired trial or failed payment) |
| Event log and technical logs | Normally up to 30 days |
| Invoices and accounting records | Five years, as required by the Norwegian Bookkeeping Act |
| Waitlist | Until you unsubscribe |
Export: You can export your entire vault yourself at any time — as an encrypted backup file or as CSV in Bitwarden-compatible format. This also applies during the 28-day period after a vault is locked, at no charge.
Deletion: You delete your vault and account permanently from settings. Deletion is final.
Payments are handled by Stripe. We never receive your card number. The trial requires no card details and does not convert automatically to a paid subscription.
If you are carrying out vendor due diligence, we can provide:
Contact: kontakt@kodovault.no
If you have found a security issue in Ko | Do · Vault, email security@kodovault.no. We confirm receipt within 3 business days and keep you informed until the issue is resolved. We do not pursue legal action against good-faith reporters who stay within their own account and their own data. See also /.well-known/security.txt.