3,322 reported US data breaches in 2025

Source: Identity Theft Resource Center — Annual Data Breach Report (2025).

Stop Renting Security From
Servers That Leak.

Global breach headlines, European privacy-by-design architecture. Cryo Dungeon Enclave keeps client-derived non-extractable keys and air-gapped recovery shards on your device — not a vendor cloud.

Open the vault in your browser — no install See plans Download archive

Set DEMO_URL in js/store-config.js to your hosted web vault (same origin path or full https:// URL on a separate app host).

Golden Master v2.0.0 — build manifest 369 files hashed

Archive SHA-256

3bb5573032f1f50b65ea38462a0758cd188f9018f7884f4b910f21a84e993699

Paste your downloaded hash to verify

See the vault

The same vault-door unlock you get in the app — try it live in your browser.

Dungeon gate → blackout → dashboard bloom. No stock UI mockups — this is the real product surface.

Open live vault demo

What you get

Outcome-first — no jargon wall. Six reasons people switch from cloud password managers.

Your secrets stay on your device

Passwords, notes, and documents are encrypted locally. There is no vendor copy of your vault to breach.

Unlock in a second

Use your passphrase, then release credentials with Face ID, Touch ID, or Windows Hello — when you choose to enroll.

Recover if you lose your phone

Split recovery shards among trusted people — no SMS reset, no help-desk backdoor.

Scan documents without uploading them

OCR runs on your device. ID and health scans never hit a server-side thumbnail cache.

Copy passwords safely

Clipboard auto-wipe after 30 seconds — pasted secrets do not linger for the next app to read.

Works fully offline

Air-gapped flight, dead zone, or paranoid mode — your vault opens without phoning home.

We can't retarget you — and that's the point.

No Meta Pixel. No ad-network SDK. This site does not fingerprint visitors — we literally cannot chase you around the web. If a breach headline brought you here, the email list is our only owned funnel (privacy lists convert the audience cloud PMs monetize with fear).

Offline-first recovery — Shamir guardian shards and air-gap QR transfer; no SMS account reset.
No vendor vault copy — ciphertext stays on your device by default; nothing central to breach.
Try before install — open the web vault demo, then move to native when you're ready.

Prefer a native app?

Get it on Google Play Download on the App Store

Set PLAY_STORE_URL and APP_STORE_URL in js/store-config.js when listings go live.

How it works

1
Create your vault

Pick a strong passphrase. Your device derives the master key — nothing is sent to us during setup.
2
Split recovery shards

Print or share 2-of-3 Shamir shards with people you trust. Each shard alone cannot open the vault.
3
Unlock when you need it

Passphrase unlocks the enclave. Optional biometrics gate credential release — they never replace your master key.

What leaves your device?

Nothing — by default. Optional Dynasty cloud sync encrypts blobs the relay cannot read.

Your device

Encrypted vault

Vendor cloud

No plaintext. No master key. No vault identity.

Cloud password manager vs Cryo

LastPass-style breaches happen because a central vault copy exists. Cryo removes that copy by default.

	Typical cloud PM	Cryo Dungeon Enclave
Vault copy on vendor servers	Yes — breach surface	No — device-only by default
Master key exportable by browser	Often yes	No — `extractable: false`
Account recovery via SMS/email	Vendor can reset access	Your shards — no backdoor
Works offline	Limited	Full vault offline
Checkout collects vault passphrase	N/A	Never — voucher only

Under the hood

Technical credibility for engineers — expand when you want the crypto detail.

Cryptographic stack (WebCrypto, chambers, escrow)

Key derivation: PBKDF2 / Argon2id paths with extractable: false AES-256-GCM keys in sovereign closure memory.
Recovery: 2-of-3 Shamir guardian shards (air-gap printable); mandatory onboarding backup is never paywalled.
Chambers: ADR-14 freeze/thaw stasis partitions — decrypt on demand, not at rest in UI.
Documents: On-device OCR (Tesseract); ciphertext only in IndexedDB / native SQLite.
Escrow / timelock: X25519 sealed release on Dynasty tier — local heartbeat, no remote custodian.
Licensing: Ed25519-signed vouchers; Stripe checkout mints entitlement JSON, never vault contents.

Honest answers

Is my data really only on my device?

Yes for the default FREE and Permafrost paths — ciphertext lives in local storage on the device you unlocked. Dynasty adds optional encrypted cloud sync; the relay sees opaque blobs, not keys or plaintext.

What happens if I lose my phone?

If you set up guardian shards, a trusted 2-of-3 quorum can help you reconstruct access — without calling us. If you skipped recovery setup and forget your passphrase, we cannot recover your vault. That is intentional.

What does checkout on this site see?

Only a Stripe payment and a signed license voucher. We never ask for your master passphrase, vault export, or document contents on this marketing site.

Do you track visitors or run retargeting ads?

No. There is no analytics pixel on this marketing site by design — we cannot retarget you because we cannot see you. That is the product philosophy, not a missing feature. The email list above is the only channel we own for breach-news spikes.

What about biometrics?

Face / fingerprint gates credential release after your passphrase has unlocked the vault. Biometrics do not derive the master key — losing enrollment does not brick the vault if you still know your passphrase.

What this does not protect against

Same honest-onboarding ethos as the in-app first-run sheet — no false comfort.

Malware on an unlocked device — if an attacker controls your OS while the vault is open, they can read what you can read.
Coerced passphrase disclosure — duress/decoy paths exist, but physical coercion is out of scope for any software vault.
Lost passphrase + no recovery shards — zero-knowledge means we cannot reset your vault.
Browser autofill on hostile sites — autofill is convenience, not anti-phishing; verify the domain every time.
Optical card NFC — not shipped; canvas presentation only in v1.

Get the vault

Fastest path: open the web demo — no tarball required. For offline / air-gapped installs, download the signed Golden Master archive below (extract, serve www/ over HTTP — not file://).

Download archive Download SHA256SUMS

Archive not hosted yet — paste the public .tar.gz URL into js/store-config.js ARCHIVE_URL after you upload it (R2, GitHub Release, etc.). A live button that 404s is worse than this note.

Archive SHA-256 v2.0.0 Golden Master

3bb5573032f1f50b65ea38462a0758cd188f9018f7884f4b910f21a84e993699

After the download finishes, check the file you actually have:

sha256sum -c SHA256SUMS
Get-FileHash .\cryo-dungeon-enclave-v2.0.0-golden-master.tar.gz -Algorithm SHA256

After download

Extract the archive.
Serve www/ over HTTP on this machine (npx serve www or python -m http.server). Opening the HTML as file:// breaks WebAuthn and IndexedDB.
Open the localhost URL and create a vault.
Optional: buy a plan on this site — Stripe returns you to claim.html with a signed voucher. This site never asks for your passphrase.
In the vault: Settings → License & Membership → import the voucher JSON.

Plans

Annual is the hero SKU — 7-day free trial on Permafrost Annual only. Monthly is an on-ramp with no trial. Self-serve checkout on this site mints a signed voucher; import it in the vault. Encrypted multi-device cloud sync is Zero Kelvin (Dynasty) and above.

Most Popular 7-Day Free Trial PRO · 365 days

Permafrost Annual

$29.99/ yr $39.99

7-day free trial included.

All 5 stasis chambers + unlimited records
Sticky notes, Shamir guardian shards, crypto vault
Document trust & batch export tools
List $39.99/yr after intro period
No encrypted cloud sync on this tier

Start 7-Day Annual Trial

Payment Link not configured yet — set PAYMENT_LINKS.PRO_ANNUAL in js/store-config.js.

PRO · 30 days

Permafrost Monthly

$2.99/ mo $4.99

No free trial — on-ramp only.

Same PRO capabilities as annual
Cancel anytime — billed monthly
Still no cloud sync — that stays Zero Kelvin+

Activate Monthly

Payment Link not configured yet — set PAYMENT_LINKS.PRO_MONTHLY in js/store-config.js.

DYNASTY · 3 years (term ceiling)

Zero Kelvin 3-Year

$109/ 3 yrs $149.97

Everything in Permafrost
Encrypted multi-device cloud sync
Escrow / timelock dispatch
~$36/yr — no lifetime SKU

Lock 3-Year Rate

Payment Link not configured yet — set PAYMENT_LINKS.DYNASTY_3YEAR in js/store-config.js.

ENTERPRISE · contract only

Organization

No self-serve Stripe

All Zero Kelvin capabilities
Org trust import, bulk revocation, gate mode
Custom Shamir scheme — vendor-issued voucher
Seat counts are contractual, not a technical cap

Contact sales

Built around European privacy principles

US breach statistics in the hero; GDPR Articles 5, 25, and 9 in the cards below — global threat surface, European privacy-by-design defaults.

GDPR Article 5(1)(c) Data minimization

No cloud residency by default — your data is architecturally minimized to the device it's created on.

GDPR Article 25 Privacy by design and by default

Non-extractable keys and local-only execution aren't a setting you turn on — they're how the encryption layer is built.

GDPR Article 9 Special-category data, isolated on-device

Biometric unlock and OCR'd ID/health document scans — special categories of personal data — are processed and stored entirely on-device, never transmitted.

This describes architectural alignment with GDPR principles, not a completed third-party audit — no SOC 2 or similar certification has been finalized for this product yet.

Stop Renting Security From Servers That Leak.