A complete breakdown of every capability in VaultNX — from cryptographic primitives to IT admin controls.
VaultNX encrypts every file individually using AES-256 Authenticated Encryption — an AEAD cipher that simultaneously encrypts and authenticates data. Forgery and tampering are cryptographically detectable, not just statistically unlikely.
Key derivation uses Advanced KDF with a memory-hardened cost profile, ensuring brute-force attacks are computationally prohibitive even on GPU arrays.
| Cipher | AES-256 Authenticated Encryption |
| KDF | Advanced Memory-hard KDF |
| KDF Memory | Memory-hardened profile |
| KDF Iterations | Multi-pass |
| KDF Parallelism | 1 thread |
| Salt | CSPRNG per vault |
| Nonce | Unique per file write |
| Auth Tag | 16 bytes (GCM) |
| File Header | Secure Metadata Envelope |
| Credential Store | Secure OS Credential Binding |
If the device exposes an SMB share accessible from Windows, VaultNX will connect to it.
Most encryption tools require a mapped drive letter, which exposes the share path in Windows Explorer and leaks credentials to the OS credential manager. VaultNX uses SMBLibrary to open a direct, private SMB session — invisible to File Explorer, invisible to other users on the same machine.
The vault is unlocked with a master password that never leaves the local machine. Strength scoring enforces minimum entropy. Wrong attempts trigger progressive lockout to prevent brute force.
Configurable idle timer (1 to 120 minutes) automatically locks the vault. Also locks instantly on Windows screen lock, user switch, remote disconnect, and machine sleep.
Clipboard auto-clear runs after a configurable interval (default 30 seconds) whenever sensitive content is copied from the vault. Prevents clipboard sniffing tools from capturing data at rest.
After 3 consecutive failed unlock attempts, the vault enters a lockout state with exponential back-off delays. Resets only on successful unlock, preventing automated guessing attacks.
The vault responds to OS power and session events: locks on sleep, hibernate, screen lock, user switch, remote disconnect, and logoff. Resumes with silent reconnect on wake / unlock.
The web-based admin panel lets IT administrators provision license keys, monitor activations, track seat usage, and revoke compromised machines — without touching end-user machines.
| Activation binding | Hardware ID Binding |
| Token format | Base64url payload + ECDSA signature |
| Token signing | Standard PKI signing |
| Offline grace | 35 days without server contact |
| Check-in interval | Weekly (background, silent) |
| Validity types | 1 year / 2 year / 3 year / Perpetual / Trial |
| Seat types | 1–unlimited per key |
| Tiers | Standard, Corporate |
| Feature | VaultNX | BitLocker | VeraCrypt | Cloud Storage |
|---|---|---|---|---|
| Per-file encryption | ✓ | ✗ | ✗ | ✗ |
| Works directly on NAS | ✓ | ✗ | Limited | ✗ |
| No drive mapping required | ✓ | ✗ | ✗ | N/A |
| Audit logging | ✓ | Limited | ✗ | Varies |
| Seat-based IT management | ✓ | ✗ | ✗ | Limited |
| No cloud dependency | ✓ | ✓ | ✓ | ✗ |
| Offline operation | ✓ (35d) | ✓ | ✓ | ✗ |
| Advanced KDF | ✓ | ✗ | PBKDF2 | Varies |
| Auto-lock on events | ✓ | ✗ | ✗ | ✗ |
| License certificate | ✓ | N/A (OS) | ✗ | ✗ |