"Secure" gets used as a blanket claim by almost every vault app, which makes it a mostly useless word on its own. The more useful question is: secure against what, and how would you actually verify it?

The main things that determine real security

  • Where the encryption key comes from. If it's derived from your own PIN and never sent anywhere, the app's developer can't decrypt your files remotely even if they wanted to.
  • Whether files ever leave your device. On-device-only storage means there's no server copy that could be exposed by a breach elsewhere — a real category of risk that cloud-synced vaults carry and local-only vaults don't.
  • What the backend stores about your account. A narrow record (email, device list, subscription tier) is a good sign that the company has deliberately limited what it collects.
  • How authentication is enforced. A PIN or biometric check required every time you open the vault, not a one-time setup that then stays open indefinitely.

What "secure" doesn't mean

No vault app protects you if your PIN is easy to guess, if you share it with someone, or if malware with root access is already running on your device — that's a broader device-security problem no single app fully solves. Vault app security is specifically about protecting files from casual access (someone picking up your phone) and from server-side exposure (a breach at the company running the app), not from every conceivable attack.

A useful test: ask whether the app works fully offline for everyday use. If it does, that's a reasonable sign your files genuinely aren't required to leave the device.

How Lockilee approaches this

On Lockilee specifically: files are encrypted on-device using a key derived from your PIN, nothing is uploaded to Lockilee's servers, and the backend record is limited to your email, registered devices, and subscription tier. The full breakdown is on the Lockilee page.

Frequently Asked Questions

Can a vault app's developer see my files?

It depends entirely on the app. If files are encrypted on-device and never uploaded, the developer never receives them and has nothing to see. If the app uploads files to a server, that's a different trust model — check which one you're using.

What happens to my vault if I lose my phone?

Since the vault's contents are encrypted on-device using a key derived from your PIN, someone who has your phone but not your PIN can't read the vault's files. This is different from account recovery, which is a separate consideration.

Is on-device storage always more secure than cloud storage?

For personal files, on-device-only storage removes one entire category of risk — a server-side breach — because there's no server copy to breach. It doesn't protect against losing the device itself, which is a different risk.

See how Lockilee handles this

Free to start, with 10 slots across files and locked apps.

Get Lockilee Free