Security & encryption

• Local first. The writing engine works entirely on your PC. Nothing you type is uploaded.
• Zero knowledge for secrets. Lumina Pass and Memory Sync data is encrypted on your device before it is stored or synced. Our servers hold ciphertext only.
• Least data. We collect only what we need to run your account and the features you use. See the Privacy Policy.

Your master password never leaves your device. When you set up Lumina Pass, the app derives a key from your master password with Argon2id — a deliberately slow, memory-hard function — using a random per-account salt and parameters tuned so that guessing is expensive. From that key the app derives separate keys for encryption and for authenticating to the sync service, so the value the server sees can never be used to decrypt anything.

A random account key is generated on your device and wrapped (encrypted) with the key derived from your master password. Your recovery kit holds an independent way to unwrap the account key; it is shown to you once and never sent to us.

• Every vault item (login, passkey, note) has its own random per-item key; the item is encrypted with AES-256-GCM, which also detects tampering.
• Per-item keys are encrypted with your account key, so items can be re-keyed or shared in future without re-encrypting everything.
• Item metadata needed for search and autofill (titles, website addresses) is encrypted too; the server sees only sizes, timestamps and revision numbers.
• Memory Sync uses the same scheme: each device uploads its own encrypted snapshot, and devices merge them locally.

Passkey private keys are generated and used on your device and stored only inside your encrypted vault. During sign-in, the app (via the browser extension) signs the website's challenge locally; the private key is never sent to the website or to us. Credentials are bound to the website they were created for, which makes them resistant to phishing.

• The extension communicates with Lumina Pass on your PC through a local, authenticated channel; vault data is decrypted only in memory, on your device.
• It fills credentials only into pages whose address matches the saved site, and asks before filling on unusual pages.
• It requests only the browser permissions it needs to detect sign-in forms and fill them.

• All connections use TLS, with HSTS on our website.
• Account passwords are hashed with Argon2id; we never store them in plain text.
• Session tokens are random 256-bit values; we store only their SHA-256 hashes, so a database leak doesn't expose usable sessions.
• Sign-in attempts are rate-limited per network and per account. You can review and revoke devices from your account page; changing your password signs out every other device.
• Administrative actions on accounts are recorded in an audit log. Production access is limited to the people who need it.

No system can protect a device that is already compromised. Keep Windows, your browser and Lumina updated, use a strong unique master password, and keep your recovery kit offline. If you lose both your master password and your recovery kit, your vault cannot be recovered — by design.

If you believe you've found a security vulnerability, please email [CONTACT EMAIL] with details and steps to reproduce. Please give us reasonable time to fix it before disclosing publicly, don't access other people's data, and don't degrade the service. We won't take legal action against good-faith research that follows these guidelines, and we'll credit you if you wish.