How your vault is encrypted: what happens on your device and what we cannot see
Essence encrypts the documents in your vault on your own device and holds no key that can open them. It can carry out your decision to share without ever being able to read what you shared.
Most online services encrypt your data, but they keep the keys. The service itself, or anyone who gets far enough inside it, can turn that data back into something readable. Essence works the other way round. The documents in your vault are encrypted on your own device, with keys created there, before anything reaches us.
Where the encryption happens
Encryption turns readable content into ciphertext that only the right key can turn back. What matters is who holds that key.
On Essence, encryption and decryption happen in the app you use. In a web browser they run in a dedicated worker; on a phone, keys are kept in the device's keychain or keystore. Your documents are encrypted with AES-256-GCM before they leave the device, and our servers receive ciphertext, along with the facts they need to run the service.
For the documents and fields in your vault, the result is that Essence holds no key capable of decrypting them, whether in escrow or under a support process. Nobody at Essence can open your vault on your behalf. Someone who broke into our servers would find ciphertext.
The cipher also guards against tampering. Each document's details are bound to its ciphertext, so if either is altered, decryption fails instead of producing something misleading. A document opens exactly as you stored it, or not at all.
The keys Essence does hold
Essence has keys of its own. They protect the running of the platform: secure connections, the signing of sign-in tokens and the platform's record of activity. They are kept apart from the keys that protect your content, and they cannot open it.
That separation matters if the worst happens. Someone who took full control of the platform's own keys could disrupt the service or impersonate it. They still could not read what is in your vault.
Sharing a field without handing over a key
Each field in a document is encrypted separately. That is what lets you share your date of birth with an organisation without sharing the passport it came from.
When you share, your device prepares access for the recipient. The server records your consent and enforces it, but at no point holds a usable key. The recipient's own device does the decrypting, and only for the fields you chose. The platform can carry out your decision to share without ever being in a position to read what you shared.
What Essence can and cannot see
Encryption hides content. Running a service still needs some facts about what is being carried, and you should know exactly which.
Essence cannot see:
- the content of your documents;
- the values of individual fields;
- your keys, your password or your passphrase.
To run the service, Essence works with:
- document metadata, such as a document's type, size, timestamps and the name of its vault;
- consent grants: who shared what with whom, for what purpose and until when, because the platform enforces them;
- billing data, and operational logs that carry no document content.
Take a bank statement in your vault. Someone with full access to our servers could learn that you hold a document of that type, updated on a certain date and shared with a named organisation for a stated purpose. They would not learn a single figure on it.
Stored content is protected a second time. The database and file storage are encrypted at rest, and backups keep both layers, so a restored backup is still ciphertext. Connections use TLS 1.3 where they can, and nothing below TLS 1.2 is accepted.
Getting back in, and erasing for good
Because nobody at Essence can reset your key, the way back into your vault is something you keep. Since our September release you can save a 24-word recovery phrase that reopens your vault. Our servers store only a proof derived from it, never the phrase itself, and that proof cannot open your vault. Write the phrase down and keep it somewhere safe, away from the device it protects.
Erasure follows from the same design. Rather than hunting down every copy of the ciphertext, the platform is designed to destroy the keys, so copies left in backups or replicas can no longer be read. The encryption that protected your data becomes the means of removing it.
What this means for you
The cryptography here is standard and well understood. What makes the difference is where it runs. For a person, that means a vault whose contents are theirs to read and theirs to share. For an organisation receiving data, it means each field arrives because the person chose to send it. If you are assessing the platform and want to go through the detail, we would be glad to take you through it.
Last reviewed 8 October 2026