VANTALOCK

Release v1.0.26

The Zero-Cloud Encrypted Vault

Military-grade AES-256-GCM encryption derived via Argon2id. Passwords, bank details, contracts, and confidential documents stay strictly on your local hardware.

Download for Windows Download for macOS Download for Linux

Encrypted Vault Storage Suites

VantaLock provides three dedicated, isolated vault compartments designed to categorize and shield all aspects of your digital life.

Financial Vault

AES-256-GCM Isolated

Comprehensive offline protection for high-value monetary credentials, banking assets, payment methods, and cryptocurrency recovery keys.

Uploadable & Storable Assets:

Bank account numbers, SWIFT/IBAN & routing codes
Credit / debit cards with encrypted CVVs & PINs
Crypto wallet seed phrases, private keys & hardware backup codes
Loan agreements, tax records & statement PDF attachments

Legal Vault

Zero-Knowledge Encrypted

Sovereign cryptographic storage for binding agreements, property deeds, personal identification, and privileged legal documentation.

Uploadable & Storable Assets:

Contracts, Non-Disclosure Agreements (NDAs) & corporate filings
Real estate title deeds, leases & property registrations
Passports, driver licenses, birth certificates & SSN/Tax IDs
Wills, estate planning documents & power of attorney records

Personal Vault

Local Sovereign Storage

Your private digital sanctuary for personal accounts, secret keys, confidential notes, identity backups, and sensitive media files.

Uploadable & Storable Assets:

Account passwords & multi-factor authentication (2FA) recovery seeds
Private journal entries, creative IP & personal correspondence
Medical records, health insurance details & prescription history
Encrypted photo & document file attachments

Cryptographic Architecture

VantaLock utilizes mathematical defense-in-depth to eliminate single points of failure and guarantee privacy.

What is AES-256-GCM and How It Works

AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois/Counter Mode) is the gold standard for authenticated symmetric encryption used by governments and high-security institutions worldwide.

256-bit Key Length: Provides 2^256 possible key combinations, making brute-force attacks physically impossible with current and foreseeable computing power.
Authenticated Encryption (GCM): Unlike standard AES modes, Galois/Counter Mode calculates a 128-bit authentication tag alongside the ciphertext. Any tampering, bit-flipping, or data corruption is detected immediately before decryption is attempted.
Unique Initialization Vectors (IVs): Every single entry and file attachment is encrypted with a fresh, random 96-bit IV, ensuring duplicate plaintexts generate completely different ciphertexts.

Key Derivation via Argon2id

Your master password is never stored anywhere on disk or in the cloud. Instead, VantaLock uses Argon2id (winner of the Password Hashing Competition) to derive the 256-bit AES key on demand.

Memory-Hard Execution: Configured with 64 MB of RAM allocation per derivation to defeat GPU and ASIC accelerated cracking attempts.
Cryptographic Salt: Combined with a 128-bit random salt stored locally to completely eliminate pre-computed rainbow table attacks.
RAM Isolation: The derived key lives exclusively in RAM during your session and is instantly purged on lock or sleep.

Encrypted Local Backups & RAM Protection

Your data security extends through the full lifecycle of your session, ensuring zero remnants remain when the vault is locked.

Local JSON Export & Import: Easily backup your entire encrypted vault to an offline USB or external hard drive. Backups remain fully encrypted with your master key.
Auto-Lock & Clipboard Scrubbing: Inactive sessions automatically lock and derived keys are zeroed out in memory. Sensitive items copied to the clipboard are purged automatically after 30 seconds.

Onboarding & Zero-Cloud Guarantee

Designed for users who demand full data sovereignty without trusting remote cloud infrastructure.

Phase 01

License Activation

Enter your Lemon Squeezy license key once. This one-time activation is the only network request VantaLock will ever make.

Phase 02

Master Key Creation

Establish your master password with real-time entropy validation. VantaLock never saves your password or key.

Phase 03

24-Word Recovery Seed

Generate and confirm a standard BIP-39 recovery phrase. This seed is your sole recovery option if you lose your password.

Installation Guide

Simple, straightforward installation across all major desktop platforms.

Windows

Windows Installer (.exe)

Click "Download for Windows", open `VantaLock-Setup.exe`, follow the setup wizard, and launch VantaLock from your desktop or start menu.

macOS

macOS Disk Image (.dmg)

Click "Download for macOS", open `VantaLock-Mac.dmg`, drag the VantaLock icon into your Applications folder, and launch instantly.

Linux

Linux Tarball (.tar.gz)

Download `VantaLock-Linux-x64.tar.gz`, extract the archive, and run `./vantalock` in your terminal or desktop manager.

Platform Specifications

Lightweight, standalone desktop software engineered for minimal system footprint.

Operating System	Architecture	Min. RAM	Disk Space	Security Features
Windows 10 / 11 (64-bit)	x86_64 / x64	512 MB	150 MB	DPAPI Encrypted Keyring, ASLR, DEP & Integrity Enforcement
macOS 11.0+ (Big Sur / Monterey / Ventura / Sonoma / Sequoia)	Intel & Apple Silicon (Universal Binary)	512 MB	180 MB	Keychain Integration, Hardened Runtime & App Sandbox Isolation
Linux Ubuntu, Fedora, Debian, Arch & Tails	x86_64 / ARM64	512 MB	120 MB	Secret Service API / KWallet Support, Memorylock (mlock) Memory Hardening

Hardware & Kernel Memory Isolation

VantaLock's runtime engine enforces low-level operating system protection mechanisms across all desktop platforms to maintain absolute data integrity and prevent unauthorized memory inspection:

RAM Memory Lockdown (mlock / VirtualLock): Key derivation buffers created via Argon2id are explicitly pinned in physical RAM memory using system calls to prevent sensitive cryptographic material from being written to unencrypted swap space or paging files.
Zero-Trace RAM Scrubbing: Master keys and temporary AES-256-GCM cipher contexts are active strictly during operation and are deterministically overwritten with cryptographically random bytes before memory deallocation.
Air-Gapped Operation: Designed to run seamlessly in completely offline, network-isolated environments (including live USB operating systems like Tails or Qubes OS) with zero external library or runtime network calls.

Frequently Asked Questions

Clear answers about security, storage, recovery, and platform operations.

Recovery & Loss: What happens if I lose my seed phrase or master key?

Because VantaLock uses zero-cloud local AES-256-GCM encryption, there is no remote server, no backdoors, and no administrative password reset option. Before storing critical items like SSNs or property deeds in the Legal Vault, confirm you have securely saved your 24-word recovery seed offline. Without the seed or password, data recovery is mathematically impossible.

Where is my encrypted vault file stored on my disk?

VantaLock stores your encrypted vault in your operating system's standard application data directory. On Windows, this is `%APPDATA%\vantalock`; on macOS, `~/Library/Application Support/vantalock`; and on Linux, `~/.config/vantalock`.

What happens if I lose my Master Password?

Because VantaLock is zero-knowledge and zero-cloud, there are no "Forgot Password" email reset buttons. You must use the 24-word BIP-39 recovery seed phrase generated during initial setup to restore access.

Can VantaLock run completely offline?

Yes. Beyond the brief 1-time license activation check upon initial launch, VantaLock requires zero internet connectivity and can operate indefinitely in air-gapped environments.