Box: Secure Vault

Box is a secure vault for everything nobody else should see: files, photos, videos, notes, documents and passwords. Everything is encrypted on your own device before it is uploaded. The server stores your content only in encrypted form and cannot read your files, notes or their names.

WHAT FITS IN THE VAULT
Text and notes, images and photos, video and audio, documents and PDF files, spreadsheets, source code, ZIP archives, installers and links, with files up to 2 GB each. One entry can hold up to 20 files, an optional title and a note. Photos open with pinch to zoom, source code with syntax highlighting and line numbers, and ZIP archives can be browsed without unpacking. PDF, Word and Excel files open as a preview on the device, never on a server. Search runs on your device and finds words in texts, titles, file names and attachment names.

GETTING THINGS IN
Pick files or photos, paste an image from the clipboard or share into Box from another Android app. Several files picked at once become one entry. After a screenshot, Box offers to upload it (only when you tap).

THREE VIEWS
Expiring holds everything with an expiry time (up to 30 days), so temporary things clean up after themselves.
Vault is permanent private storage where your files, documents and notes stay until you delete them.
Shared lists every active link you handed out, with its time left and number of views.

SECURE FILE TRANSFER AND SHARING
Any entry can become a link. The recipient needs no account and no install, just the link (and the password, if you set one) and a web browser on a phone or computer. You decide how long the link lives (15 minutes to 30 days, never longer than the entry), you can change that later, revoke the link at once, or limit it to 1, 3, 5 or 10 views. A link carries the text or the file of the entry, attachments stay in your vault.

PASSWORDS AND SECRETS
Logins, Wi-Fi passwords, PINs, API keys and recovery codes live as encrypted notes next to your files, synced and searchable. Copying takes one tap; Box does not fill passwords into websites or other apps.

SECURITY
- End-to-end encryption with AES-GCM 256, performed on your device
- Your password becomes the key with Argon2id (64 MiB memory, 3 passes), so every guess is expensive
- Your password does not leave the device: at sign-in the server gets only a value derived from it (older accounts switch to this and to Argon2id at their next sign-in)
- The server gets your key only in encrypted form. Besides encrypted data it stores metadata such as the kind of entry, its size and dates; file names and file types are encrypted
- Share links carry their own key after the # sign; an optional password is part of that key, and 10 wrong tries lock the link for 5 minutes
- Two-factor sign-in with an authenticator app, and a recovery code for your data
- Fingerprint sign-in sealed in the Android Keystore, with StrongBox where the phone has it
- App lock with fingerprint or screen lock
- A list of your devices and sessions, and one button to sign out everywhere else
- The Android app runs its own code from the signed app, not from the server
- Servers in Germany: Supabase in Frankfurt, files over 45 MB on a Sortia Labs server

THE SAME VAULT EVERYWHERE
The Android app and the web app on box.sortia.de show the same content, and changes appear on your other devices right away. The web app runs in current browsers and installs as a progressive web app.

NO ADS, NO TRACKING
Box carries no advertising, no analytics SDKs and no profiling. Your data is not sold and not shared with third parties.

ACCOUNTS
Box accounts are currently created by invitation (request access at info@sortia.de). People you share with never need an account.

Some features may be available only with a paid plan or as an in-app purchase, now or in the future. The app shows this, with the price, before anything is charged.

Privacy policy: https://www.sortia.de/datenschutz/#box
By Sortia Labs, sortia.de