FILES LOCKED. IDENTITY VERIFIED.
Every file locked behind AES-256 encryption, fingerprint-gated before it can be opened or deleted, and watched by a signature-based detection layer that never sleeps. Nothing leaves your own infrastructure.
Three Mechanisms, One Vault
Each objective in the project scope maps to an enforced mechanism — not a claim, a working part of the architecture.
Cipher Layer
Every file is encrypted with AES-256 the instant it's uploaded, and only decrypted in-memory for the verified owner. A stolen disk yields ciphertext, nothing more.
Access Ledger
Admin and user roles scope the vault per account. Every login, upload, download, delete, and role change writes a permanent line to the activity log — reviewable from the Access Control dashboard.
Threat Watch
Signature-based rules watch for brute-force patterns, fingerprint mismatches, and malware in uploaded files. A crossed threshold locks the account, logs the alert, and sounds a physical buzzer.
What happens between login and a file leaving the vault
Four checkpoints run in sequence before a single file is decrypted.
Password
Bcrypt-hashed credentials checked against the account. Five wrong guesses locks it — no timer, an admin has to clear it.
Role check
Admin or user — the dashboard and file list scope themselves to what that role is allowed to touch.
Fingerprint step-up
Triggered only when you try to download or delete a file — a single-use, 30-second grant read from the AS608 sensor. Logging in never requires it.
Decrypt on demand
Files sit encrypted at rest and are only opened in memory once the fingerprint grant clears, then re-sealed.
Five Enforced Mechanisms
Not a feature list — each one is a check that runs in the live request path, with a log entry to show it happened.
AES-256-CBC Encryption
Every file is encrypted the moment it's uploaded, with its own randomly generated IV so two identical files never produce the same ciphertext. Decryption happens only in memory, only for the verified owner, and the plaintext never touches disk.
Password Login + Fingerprint Step-Up
Signing in only ever needs a bcrypt-hashed password — nothing physical is required to reach the dashboard. The AS608 fingerprint sensor comes in later, at the moment you try to download or delete a file: a single-use, 30-second verification grant that expires the instant it's consumed.
Admin-Cleared Lockouts
Five failed attempts locks the account and raises an intrusion alert. There's deliberately no auto-expiring timer — a locked account stays locked until an administrator reviews and clears it, closing the gap a timed lockout leaves open.
ClamAV Signature Scanning
Every upload — vault files and profile pictures alike — is scanned by ClamAV before it's ever encrypted or stored. A detected threat is rejected outright and logged with the exact signature name; if the scanner itself is unreachable, the upload is blocked rather than silently skipped.
Hardware Buzzer
High-severity intrusion events — repeated brute-force attempts, a fingerprint mismatch on a download or delete attempt, a confirmed malware upload — don't just sit in a log waiting to be checked. A physical buzzer fires in real time, so a threat gets noticed even away from the dashboard.
Before You Ask
The things people check before trusting a vault with real files.
What happens if I upload an infected file?+
It never reaches storage. Every upload is scanned by ClamAV before encryption — a detected threat is rejected outright, logged to the intrusion log with the signature name, and the file is never written to disk.
Do I need my fingerprint to log in?+
No. Logging in only needs your password. Your enrolled fingerprint is checked separately — only at the moment you try to download or delete a file. That verification is a single-use grant that expires after 30 seconds, so even a hijacked session can't walk away with a file without a live scan on the sensor.
What happens after too many failed login attempts?+
The account locks after 5 failed attempts and an intrusion alert is raised. There's no auto-expiring timer — an administrator has to explicitly review and unlock it.
What happens if the fingerprint doesn't match?+
The download or delete is blocked outright, and the mismatch is logged as an intrusion alert — the same as a failed login attempt, just tied to that specific file action instead.
Where are the files actually stored?+
On the same infrastructure that runs the application, fully encrypted — no third-party cloud storage in the path. Each file has its own unique IV, so no two encrypted outputs look alike, even for identical source files.
Can a regular user see what admins see?+
No. Role-based access control scopes the dashboard itself — regular users only manage their own files, and only admins see the full intrusion log, access ledger, and account management tools.
Open your vault
Register, enroll your fingerprint, and your files are encrypted from the first upload — with that fingerprint standing guard the moment you try to download or delete one.
Create your vault →Talk to the team
Want SecureVault for your hospital, bank or organisation, or want a live demo? Email us and tell us a bit about what you need to protect.
If the Email us button doesn't open your mail app, copy the address and send from any email account.