Security Architecture

Security Policy

Last updated: July 22, 2026

AES-256 Encryption

Military-grade encryption standard used by governments and financial institutions worldwide.

Zero-Knowledge Architecture

Your Encryption Password never leaves your device. We cannot access your data — by design.

1. Overview

Safety Photo+Video employs a comprehensive security architecture designed to ensure your photos and videos remain private and protected. This document details our encryption methods, key management approach, and security practices.

Our Zero-Knowledge design means that even if our servers were compromised, your encrypted data would remain secure and unreadable without your Encryption Password.

2. Encryption Password Architecture

Your Encryption Password is Your Key

When you create your Safety Photo+Video account, you choose an Encryption Password. This password is used to derive your unique encryption keys using industry-standard key derivation functions. We never see, store, or transmit your Encryption Password.

How It Works

1

Password Entry

You enter your Encryption Password on your device

2

Key Derivation

PBKDF2-SHA256 derives a 256-bit master key from your password

3

Key Expansion

The master key generates file-specific encryption keys

4

Local Use

The key is used on the device to encrypt and decrypt protected backup files

3. AES-256 Encryption Details

We use AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode) for all file encryption. This provides:

256-bit key length — 2²⁵⁶ possible combinations
Authenticated encryption — Detects tampering attempts
Unique IV per file — Prevents pattern analysis
Documented for protected backup-file encryption

4. Zero-Knowledge Design

The current product design and store listings describe the following behavior for encrypted cloud backups:

  • Server Blindness — Our servers store only encrypted blobs with no knowledge of contents
  • User-Held Key — Only the user holds the key needed to decrypt the backup
  • On-Device Encryption — Protected media is encrypted before it is uploaded
  • Password Responsibility — Support cannot recover the Encryption Password needed to decrypt protected media

5. Security Best Practices

To maximize the security of your account, we recommend:

  • Choose a strong, unique Encryption Password (16+ characters recommended)
  • Store your Encryption Password in a reputable password manager
  • Keep a physical backup of your Encryption Password in a secure location
  • Enable biometric authentication on supported devices
  • Keep your device operating system and app updated
  • Never share your Encryption Password with anyone, including our support team

6. Security Contact

If you discover a security vulnerability, please report it responsibly to support@safetyphoto.app

Include detailed reproduction steps, and do not access user data or disrupt services while investigating a report.