FigLockPrivacy
The short version
- We run no server or database that stores your vault. There are no FigLock accounts.
- Your vault is encrypted on your device before it goes anywhere. Item titles, URLs and usernames are encrypted too.
- Your storage provider sees ciphertext, plus file counts, sizes and times. Nothing else.
- The phone-approval relay is optional. It passes encrypted messages along and stores nothing.
- FigLock has no telemetry by default, and this website uses no cookies, analytics or third-party scripts.
Where your data lives
Your vault is a set of encrypted files. A full copy sits on each of your devices, and the same files are kept in the storage you choose when you set up: Google Drive, iCloud Drive, or a folder you sync yourself. Git and S3 may follow later.
Everything is encrypted with keys derived from your master password and your Secret Key. Both stay with you. We never receive them, so we can't read your vault, and we can't reset your password. If you lose both your master password and your Secret Key, the data can't be recovered. The Emergency Kit exists for that reason.
Who can see what
- You and your approved devices
- Your items, once you unlock the vault.
- Your storage provider
- Encrypted files, how many there are, how big they are and when they changed. Not titles, URLs, usernames or values.
- The optional relay
- Encrypted approval messages in transit, with their sizes and timing. It can't read them or create an approval, and it keeps nothing.
- FigLock project maintainers
- Nothing about your vault. We don't have it.
Google Drive
If you pick Google Drive, FigLock asks for one narrow permission, drive.appdata. It gives FigLock a hidden app folder and no access to the rest of your files. The folder counts against your Drive storage, and you can remove it from your Google account settings. Removing it deletes the copy in Drive, so each device keeps its own full local copy.
Agents and the audit log
When an agent asks to use a secret, the decision and the use are recorded in an encrypted audit log inside your vault. It is yours to read and export. FigLock does not send it anywhere.
Approving an agent only limits what the agent is handed. A secret can still reach an agent's transcript if you choose to reveal it, which needs its own approval each time. We try to say plainly what is and isn't protected.
The optional relay
If you want to approve an agent request from your phone, an optional relay at relay.figlock.com forwards encrypted approvals between your devices, including through Apple's push notification service. It holds no vault data and no keys, and everything works without it.
This website
These pages are plain static files. They set no cookies, run no analytics and load nothing from other sites, including fonts. Like any web host, the service that delivers these pages may keep standard request logs, such as the address a request came from and the time. FigLock adds nothing on top of that.
Your choices
- Export everything, encrypted or plain, at any time.
- Delete the vault files from your storage and your devices, and your data is gone.
- Revoke a device to cut it off from future changes.
Changes and contact
If this page changes in a way that matters, the date at the top will change with it. To report a security problem, write to security@figlock.com. Please don't include real vault data, tokens or recovery codes in a report.