Local operation
Prepared access-state changes and vault access are being designed to operate without a server round-trip.
Security posture
Security claims should follow
implementation evidence.
Liberty Lock is in development. This page documents the security goals and limits guiding the product—not a certification, completed audit, or released guarantee.
Responsible disclosureWorking posture
Reduce exposure before adding complexity.
The security model begins with a narrow question: which information must be visible for a given action? Data that never reaches a system cannot be disclosed by that system.
- 01Current fact
- The website and product model are public. The app is in development for iOS and Android, planned to launch on both at the same time. There is no launch date yet.
- 02Planned for launch
- Secure Vault, two PINs with three views, Quick Lock, local encryption, and optional encrypted backups with a recovery kit.
- 03Coming later
- Trusted Signal location rules, Panic Mode with trusted contacts, and remote wipe, after launch validation.
- 04Design target
- Your phone, not Liberty Lock’s servers, holds the keys, so company systems have no readable view of vault content.
- 05Platform dependent
- Planned key protection depends on the security capabilities exposed by supported iOS and Android devices.
- 06Open question
- Exact backup, recovery-kit and account behaviour will be documented before launch.
- 07Not claimed
- No audit, certification, performance benchmark or cryptographic guarantee is presented as complete. A security audit is part of the build plan.
Threat boundaries
Four constraints guiding development.
These constraints are useful only if the final implementation can be tested against them.
Narrow service visibility
Protected material is intended to remain outside readable company systems during normal operation.
Platform constraints
Key protection and authentication must use supported iOS and Android security capabilities rather than bypassing the operating system.
Documented recovery
Recovery convenience can weaken confidentiality. The final design must state exactly who can recover what and under which conditions.
Limits
What Liberty Lock can’t do.
Plain limits are part of the product. They build the trust a privacy tool depends on.
- It changes what Liberty Lock shows, not the rest of your phone.Your other apps, photos and messages outside the vault are untouched.
- Anyone can see Liberty Lock is installed.Secondary Access is designed to look like ordinary use, not to hide the app.
- Lose your phone without your recovery kit, and you lose your vault.Liberty Lock is designed so it can’t open or restore your vault for you.
- It isn’t a way around the law.It protects your privacy from people with no right to your data. It doesn’t change your legal obligations.
- It isn’t a crypto wallet.It stores recovery phrases securely but doesn’t hold, send or trade crypto.
Visibility model
Planned local and service responsibilities.
The diagram describes the intended boundary. It does not certify a released implementation.
Access state LOCALProtected content LOCALContext rules LOCALKey material PLATFORM PROTECTED
Planned boundaryProtected content / context / keys do not cross
Account state IF REQUIREDSubscription state IF REQUIREDBackup material CIPHERTEXTReadable vault content OUTSIDE SCOPE
Responsible disclosure
Report a security concern.
If you identify a credible issue in the website, mobile application, or supporting infrastructure, describe the affected surface, reproduction steps, and relevant proof of concept. Avoid accessing, changing, or deleting other people’s data.
Email security disclosure