Security at VAULT

Your music stays yours.

Unreleased music is the most valuable thing you send around. Here is where your files live, who can reach them, and what happens when you share them.

Follow a track

Last updated October 2026

ProtectionMaster · WAV

Lose Control

Remy Cooper

Private

03:41

Stored in the EUAmsterdam, NL
Encrypted at restAES-256
Never used to train AITraining: never
Private links that expireExpiry + revoke

The journey of a track

From your session to their headphones.

Every step a track takes in VAULT, and what protects it at that step.

01 · Upload
You add a track
Files travel from your computer or phone over an encrypted connection.
Lose Control (master).wav48.3 MB
HTTPS · HSTS
02 · Analysis
Analysis on your device
BPM and key are calculated in your browser. Your audio does not leave your device for it.
BPM
92
Key
F♯m
Local · no AI
03 · Storage
Encrypted storage
The file is stored in Amsterdam and encrypted at rest.
AES-256Amsterdam, NL
AES-256 · Amsterdam
04 · Sharing
Private sharing
Only the people you invite can open it, with the role you give them.
Editor
Viewer
Invite only · roles
05 · Listening
Expiring links
Playback runs through signed links that stop working after a short time.
Expires 14 Nov
Signed · expiring

01 · Upload
You add a track
Files travel from your computer or phone over an encrypted connection.
Lose Control (master).wav48.3 MB
HTTPS · HSTS
02 · Analysis
Analysis on your device
BPM and key are calculated in your browser. Your audio does not leave your device for it.
BPM
92
Key
F♯m
Local · no AI
03 · Storage
Encrypted storage
The file is stored in Amsterdam and encrypted at rest.
AES-256Amsterdam, NL
AES-256 · Amsterdam
04 · Sharing
Private sharing
Only the people you invite can open it, with the role you give them.
Editor
Viewer
Invite only · roles
05 · Listening
Expiring links
Playback runs through signed links that stop working after a short time.
Expires 14 Nov
Signed · expiring

You stay in control

Every link is yours to shape, follow and close.

Share links carry the settings labels and managers expect. Set them once, change them later, or turn a link off.

Link expiry
Pick the date a link stops working.
Password protection
Ask for a password before anyone can listen.
Downloads off by default
Listeners can stream. Downloading is something you switch on.
Watermarked downloads
Each download carries an inaudible watermark and a VAULT rights record.
Revoke anytime
Turn a link off whenever you want.

Link expiry and passwords come with Creator and up. Watermarked downloads come with Pro.

Link settingsPublic link

Lose Control · A&R review

Remy Cooper

Access

Link expiry

14 Nov 2026

Password protect

What to show

Allow download

Off by default

Off

Watermarked downloads

Adds an inaudible watermark and VAULT rights record.

Revoke linkCopy link

Workspace roles

Give each person the access they need. Permissions can also be set per song or playlist.

RCRemy CooperOwner
JJeannaManager
LLLife Is A LoopEditor
DNDaniel NoletViewer

Per resourceCymatic · playlist access

Activity on shared links

See when a link is opened, played or downloaded.

Opens: 14
Plays: 37
Downloads: 2

Played Lose Control (master)2 min ago
Opened the link6 min ago
Downloaded, watermarkedYesterday

What we don't do

Lines we do not cross.

01
We never train AI on your music.
Your catalog is not a dataset. We do not train models on it, and the AI providers we use do not either.
02
We never sell your data.
Not your catalog, not your contacts, not your listening activity.
03
We don't listen in.
We do not open or play your files. The one exception is a support session you ask for, and it is logged.

When AI sees your music

Where AI is involved, and where it is not.

Here is exactly what is sent, where it goes, and what never leaves your device.

Stays on your device

BPM and key detection

Calculated in your own browser with classic signal analysis. No AI is involved, and your audio does not leave your device for it.

Where AI is involved

Your track
OpenRouter
AI provider
Tags back

Auto-tagging

Sends up to the first 5 minutes of audio, as a compressed copy, to an AI provider through OpenRouter.

Up to 05:00
Compressed copy
Zero data retention
Data collection denied

Conductor assistant

Sends your chat and the catalog details you refer to, so it can answer.

Your messages
Referenced catalog info

Search by sound

An open AI model on our own server turns each track into a sound fingerprint, so you can search by how it sounds. Nothing is sent to an outside provider for this.

Own server
Fingerprint only
No training

Providers do not train on what we send.

Who can access your account

No teams with access.

At large platforms, access to customer files is often spread across whole teams. At VAULT, one person holds admin access: the founder, protected by a passkey.

Typical large platform

VAULTOne admin · passkey

Support access only when you ask

Every support session needs a fresh passkey confirmation.
A session lasts 60 minutes at most.
A reason is recorded for every session.
Every session is written to an audit log.
Sensitive admin actions each need their own passkey confirmation.

Support session60 min limit

Reason

Help restoring a playlist order after an import

Active

Time left58:41

Audit log

14:02Passkey confirmed
14:02Support session started, reason recorded
14:09Playlist viewed

Account security

Require a passkey at sign-in

After signing in with another method, confirm with a passkey.

Recovery codes

Keep these offline in case you lose access to your passkeys.

Generate new codes

Active sessions

Safari on macOSCurrent session
Last active 17 Oct 2026, 14:12
Sign out
VAULT for iPhone
Last active 16 Oct 2026, 22:40
Sign out
Chrome on Windows
Last active 3 Oct 2026, 09:05
Sign out

VAULT

09:05

New sign-in to your VAULT account

Browser or app: Chrome on Windows

Your account security

Protection you can turn up.

Two-step verification with passkeys
Optional for every account. After signing in, confirm with a passkey.
One-time recovery codes
Keep them offline in case you lose your passkeys. Each code works once.
Active sessions
See where you are signed in, and sign out any session.
New sign-in alerts
We email you when your account is used from a new browser or app.

Infrastructure and partners

Where everything runs.

The companies that run parts of VAULT, what they do, and where.

Role	Partner	Detail
Application and database	Hostinger	Frankfurt, DERuns the app and its database.
File storage	Wasabi	Amsterdam, NLEncrypted at rest with AES-256.
Delivery	Bunny CDN	SI · globalServes files through signed links that expire, from the server closest to the listener.
Email	Amazon SES	Frankfurt, DESends account and notification emails.
Payments	Polar	USMerchant of record. VAULT never stores card details.
AI, only when used	OpenAI, OpenRouter	USOnly for AI features you use. No training on your data.
Error monitoring	Sentry	Frankfurt, DEAlerts us when something breaks.

Application and database
HostingerFrankfurt, DE
Runs the app and its database.
File storage
WasabiAmsterdam, NL
Encrypted at rest with AES-256.
Delivery
Bunny CDNSI · global
Serves files through signed links that expire, from the server closest to the listener.
Email
Amazon SESFrankfurt, DE
Sends account and notification emails.
Payments
PolarUS
Merchant of record. VAULT never stores card details.
AI, only when used
OpenAI, OpenRouterUS
Only for AI features you use. No training on your data.
Error monitoring
SentryFrankfurt, DE
Alerts us when something breaks.

HTTPS everywhere
All traffic, with HSTS
Strict content security policy
Limits what a page may load
Daily encrypted backups
Database · kept 30 days · EU

Only when you use it or allow it

These partners only see data when you turn a feature on, use the mobile app or accept cookies.

Role	Partner	Detail
Bot protection	Cloudflare Turnstile	US · globalChecks that sign-up and submission forms are used by people.
Product analytics	SiteBehaviour	Frankfurt, DEPage flows and heatmaps, only after you accept analytics cookies.
Advertising	Meta, TikTok	IE, USOnly after you accept advertising cookies.
Push notifications	Expo, Apple, Google	USDelivers notifications when you turn them on in the mobile app.
App store subscriptions	RevenueCat	USUnlocks your plan when you subscribe in the iOS or Android app.
Review moderation	Telegram	AE · globalReceives reviews you submit for moderation, never your email address.

Bot protection
Cloudflare TurnstileUS · global
Checks that sign-up and submission forms are used by people.
Product analytics
SiteBehaviourFrankfurt, DE
Page flows and heatmaps, only after you accept analytics cookies.
Advertising
Meta, TikTokIE, US
Only after you accept advertising cookies.
Push notifications
Expo, Apple, GoogleUS
Delivers notifications when you turn them on in the mobile app.
App store subscriptions
RevenueCatUS
Unlocks your plan when you subscribe in the iOS or Android app.
Review moderation
TelegramAE · global
Receives reviews you submit for moderation, never your email address.

Location is where data is processed. Global means it passes through servers worldwide, closest to the person using it.

Full subprocessor details in the privacy policy

Beta

Honest about where we are.

VAULT is in beta. Most things run smoothly, but now and then you may run into a bug, and in rare cases VAULT can be offline for a short while. We do not expect it, but it can happen, so plan for it.

We usually know before you do
Errors are reported to us automatically, so most problems are on our list the moment they happen. Error reports hold technical details, never your audio files.
Spotted something we missed?
Tell us through support and we will pick it up.
Keep your own masters
As with any online service, keep your own copy of important masters.

Contact support

Report a vulnerability

Found a security issue? Tell us directly.

Email the details and the steps to reproduce. Please give us time to fix an issue before you share it publicly.

security@toolkit.music