VeloGuardian Vault
Your family's documents, sealed and remembered.
Passports, IDs, visas and the rest of the family's papers in one vault, encrypted on your phone before anything is uploaded. Your phone reminds you before each one expires.
Features
Every family paper, in one place.
Passports, IDs, residence visas, driving licences, car registration, insurance, tenancy and school papers, for everyone in the family.
-
Scan, snap or upload
Add a document with the phone's document scanner, a photo, or a file (PDF or image).
-
Read on your phone
Your phone finds the name, the expiry date and the machine-readable lines of passports and IDs. If it cannot find a date, Read with AI is there for that one document, only if you choose it.
-
Reminders before it expires
90, 30 and 7 days before, and on the day, at 9:00. Worked out on your phone, so we never learn an expiry date.
-
The whole family
Invite people in person by QR code. Each person's documents sit in their own row, and you can add someone without a phone, like a child.
-
Share a watermarked copy
Who it is for and the date across every page, by a link that stops working when you choose.
-
Encrypted on your phone
Every page, thumbnail and detail is encrypted before it is uploaded. Our server stores sealed files and cannot open them.
Sharing a copy
A copy that says who it's for.
When a rental desk, a school or a landlord asks for your passport, send a copy that is marked for them and stops working on its own.
-
Say who it is for
It is printed across every page, with the date.
-
Choose how long
The link stops working after 1 hour, 24 hours or 7 days. End it sooner any time, and see how often it was opened.
-
Send the link
They open it in their browser. No app, no account.
Turn on Allow download and they can save a PDF, with the watermark on every page. A screenshot cannot be stopped; the watermark is there so any copy shows who it was for.
Who it's for
For families with papers to keep.
Families with residency papers
Visas, residence IDs and passports to renew for everyone, with a reminder 90 days before each one runs out. See the featuresParents with children's passports
Add a child without a phone and keep their passport and school papers in their own row, encrypted like everything else. How it's protectedAnyone asked for "a copy of your passport"
Send a watermarked copy that names who it is for and stops working, instead of a photo that lives on in a chat. How sharing worksThe design
Written down so it can be checked.
Every page, thumbnail and detail you put in the vault is encrypted on your phone before it is uploaded. Our server stores sealed files and the facts it needs to pass them between your family's phones. It never holds a key that opens them.
We use standard, published building blocks and no constructions of our own. This is the whole design, published in October 2026.
The keys
- Your device key
- Each phone makes its own key pair (X25519) when you start or join a vault. The private half stays in the phone's key store; only the public half is sent to us.
- The family key
- A random 256-bit key, made by the first phone. For every phone in the family, that key is sealed to the phone's public key (an X25519 key agreement, HKDF-SHA256, then XChaCha20-Poly1305) and the sealed copy is stored with us. Each phone opens its own copy; our server never sees the family key itself.
- A key per document
- Each document has its own random 256-bit key for its pages, thumbnails and details (XChaCha20-Poly1305). That key is wrapped with the family key and stored next to the document.
- A key per shared copy
- A shared copy gets a fresh key, used once, that travels in the link itself (see Shared copies below).
- The recovery code
- Optional. 128 random bits, shown as 26 letters and digits. On your phone, Argon2id (19 MiB, 2 passes) turns it into a key pair. We store only the public half and the family key sealed to it, so any phone in your family can re-seal a new family key to it without knowing the code.
Nothing is made from your account password. You can change your password; the vault's keys stay the same. Every encrypted file starts with a version byte, so the format can change later without guessing.
Where your device key is kept
In your phone's own secure key store, on that device only. It never leaves it, not even to a cloud backup. Each phone is its own device: a new one joins by scanning a code on a family phone, or with your recovery code.
If you have no other phone in the family, the recovery code is the only way back in. Without it, the vault is gone for you. We say this before you start, because we cannot reset it.
Letting someone in
-
Your phone shows a code
A one-time invite for 10 minutes, with a secret that never reaches our server.
-
Their phone answers
It sends its public key with a proof made from that secret.
-
Your phone checks it
Only then does it seal the family key to them. Until then they see nothing.
Your phone asks us for a one-time invite that lasts 10 minutes and shows it as a QR code, together with a 16-byte secret that never reaches our server. Their phone sends its public key with a proof made from that secret (HMAC-SHA256). Your phone checks the proof before it seals the family key to them, so a server that swapped in its own key would be caught, and it gives the new phone its own proof made with the family key (HKDF-SHA256 and HMAC-SHA256 over the phone's public key): whenever a new family key is made, it is sealed only to phones that carry such a proof, so someone with a member's password, or our server, cannot slip in a phone of their own. Until your phone has done this, they are waiting and can see nothing. Our server cannot add anyone by itself: it has no family key to give.
What our server stores and knows
Sealed files go to object storage in the EU, uploaded and downloaded with short-lived links, so the bytes never pass through our own servers. Our database holds who belongs to which family, each phone's public key and sealed family key, the documents' file ids and sizes, shared copies (what you typed as the purpose, dates, how often it was opened), the recovery record, and counters.
It holds no document type, title, name, number, date or thumbnail. A full copy of our servers would show which accounts share a family, how many documents and pages each family has and when they changed, file sizes, how often copies are shared and opened, and whether an account used Read with AI. Your phones keep the vault in step by asking for the changes since their last check; reminders are worked out on your phone from the decrypted details, so we never learn an expiry date.
Shared copies
When you share a document, your phone draws the purpose, the date and "VIEW ONLY" across every page, makes the pages smaller, encrypts them with a fresh key (AES-256-GCM, because browsers have it built in) and uploads one sealed file. The link looks like veloguardian.com/d/<id>#<key>. The id is 128 random bits. The key sits after the #, which browsers never send to any server, us included.
The page that opens the link unlocks the copy in the recipient's browser. It sets no cookies and talks only to our site, our API and the storage that holds the sealed file. An expired, ended or unknown link shows the same page, so links cannot be guessed. Link previews in messaging apps do not run the page, so they never count as an open. You can end a copy at any time; ended and expired copies are deleted from storage within minutes.
When you share a copy you can allow download, and the recipient can then save it as a PDF made in their browser, with the watermark on every page (without "VIEW ONLY").
Read with AI
Reading a document happens on your phone. Read with AI is an extra you choose for one document at a time. It sends this one document to our server, which reads it once with an AI provider. The provider may keep it for up to 30 days for abuse checks, then deletes it. We keep a record of each read for the daily limit, for 30 days, not the document or what was read from it.
Removing someone, losing a phone, leaving
When a member or a phone is removed, our server deletes its sealed family key at once. A new family key is made (by the phone that removed it, or the next family phone to open the app), every document key is re-wrapped with it and sealed to each remaining phone, so the removed phone cannot open any document added afterwards. A document it had already seen keeps its own key until that document is replaced, so later changes to that document are not protected from it the same way; our server also stops giving it the files. What it had already seen, it may still have.
If you lose a phone, remove it from Account on another phone, then join again on the new one with a QR code from a family phone, or with your recovery code. If you leave and others stay, your documents stay with the family. If you are the last member, or you delete your VeloGuardian account as the last member, the vault and all its files are deleted and its shared copies end. Only someone alone in the vault can delete it (by typing "delete"); while others are in it, you can leave or remove members, and our server refuses a delete too.
FAQ
Common questions.
No. Every page, thumbnail and detail is encrypted on your phone before it is uploaded. Our server stores sealed files and never holds a key that opens them. The one exception is Read with AI, which you choose for one document at a time: that document is sent to our server and read once.
Remove it from Account on another family phone, then join again on the new phone with a QR code from a family phone, or with your recovery code. The removed phone cannot open any document added afterwards. If you have no other phone in the family, the recovery code is the only way back in: we cannot reset the vault for you.
Your phone reminds you 90, 30 and 7 days before a document expires, and on the day itself, at 9:00. The reminders are worked out on your phone from the decrypted details, so we never learn an expiry date.
Yes. Share a copy instead of the photo: who it is for and the date are printed across every page, and the link stops working after 1 hour, 24 hours or 7 days. You can end it at any time and see how often it was opened. A screenshot cannot be stopped; the watermark is there so any copy shows who it was for.
No. They open the link in their browser, with no app and no account. If you turn on Allow download, they can also save a PDF, with the watermark on every page.
Everyone in the family vault sees everything in it. Each person's documents sit in their own row, and you can add someone without a phone, such as a child. You invite people in person, by QR code.
Your phone reads documents on its own: the expiry date, the name and the machine-readable lines of passports and IDs. When it cannot find a date, you can choose Read with AI for that one document. It is sent to our server and read once by an AI provider, which may keep it for up to 30 days for abuse checks. We keep only the time of each read, for the daily limit.
Questions about the design?
Ask us anything about how the Vault keeps your family's documents sealed.